download: | local-http-files-server-software.zip |
Full analysis: | https://app.any.run/tasks/50e238bd-af76-4000-a952-56e0ea1ab844 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 17:17:28 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 3949691028211782115E6E0E49230678 |
SHA1: | FBB7F7A25C36B831CE5D616F4F3A8B4E6F63BDDA |
SHA256: | A3B0ACBCE36E00693299B10F25FFC5792C03DAAD75DAD421F452BC35517D1C6F |
SSDEEP: | 6144:y9fy9QiDq3LPeWWP5qwRQe8+kZZmH+jzGNYTIUmJpmWxBgOLu:y9K99D6L2WWxq678vWuyNm1mJpjgOC |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | local_http_server.exe |
---|---|
ZipUncompressedSize: | 705024 |
ZipCompressedSize: | 246148 |
ZipCRC: | 0x62085347 |
ZipModifyDate: | 2020:08:14 14:05:19 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2944 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\local-http-files-server-software.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
1888 | "C:\Users\admin\Desktop\local_http_server.exe" | C:\Users\admin\Desktop\local_http_server.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
3720 | "C:\Program Files\Internet Explorer\iexplore.exe" https://software-download.name/serve-static-files-locally/?local_http&20.08.14 | C:\Program Files\Internet Explorer\iexplore.exe | local_http_server.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3684 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3720 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\local-http-files-server-software.zip | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2944 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2944.21789\local_http_server.exe | executable | |
MD5:AEF9FBF9A4648EA30DBB9B4CFD312EA5 | SHA256:36B9FE43E8E54E36BB6B8AD06B3CC9B6F6CEA22CAF32827E415F145C2E78F9FC | |||
3720 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFF67C6E2FFBB28ACE.TMP | gmc | |
MD5:EA0A5192A4FD1048028205AC4546AD18 | SHA256:EA99ED48223D957A08BEAA515D560DC81BA3FF176EB4A4076FE19311ADFDA8F2 | |||
3684 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar2D8D.tmp | cat | |
MD5:E721613517543768F0DE47A6EEEE3475 | SHA256:3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E | |||
3684 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:6974458F4BB227857A056DD8F593BDB4 | SHA256:EDAF67BDD18968F6A4DF5D7672DD69312C55A87D5BF28514BEEC4C6E9EE92C70 | |||
3720 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF2E4ED4F877F419DC.TMP | gmc | |
MD5:62E89DBA244E2E1D660FF21B1AABB1C5 | SHA256:C3D549D016E9B514A6CAE35CBB4D58EEDD6EDEB7D19F1CEAD830FBD4CDD768F7 | |||
3684 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab2D8A.tmp | compressed | |
MD5:B9F21D8DB36E88831E5352BB82C438B3 | SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E | |||
3684 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:914463054F6CB61D6BC5B9BE3BF29374 | SHA256:7D5C80DA218DDAD63CC7D506C26F985CD3EE8B0F89F4371FFE7F3360C34D6C6B | |||
3684 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab2D8C.tmp | compressed | |
MD5:B9F21D8DB36E88831E5352BB82C438B3 | SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E | |||
3720 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63 | binary | |
MD5:48F3BCACDC2752AF5BB298E89374D4FF | SHA256:5CA360059AFA6206878178B3876636049D320FA4FB12C0D43E7B24B1E32BE7FF | |||
3684 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:B9F21D8DB36E88831E5352BB82C438B3 | SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3684 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7ce99c6af3d189a8 | US | compressed | 60.0 Kb | whitelisted |
3684 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?51f9e771090ba962 | US | compressed | 60.0 Kb | whitelisted |
3684 | iexplore.exe | GET | 200 | 96.16.145.230:80 | http://x1.c.lencr.org/ | US | der | 717 b | whitelisted |
3684 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?67a0f97e30cc9ae0 | US | compressed | 4.70 Kb | whitelisted |
3684 | iexplore.exe | GET | 200 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?73c0825a8a82b8b4 | US | compressed | 4.70 Kb | whitelisted |
3720 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3720 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
3684 | iexplore.exe | 96.16.145.230:80 | x1.c.lencr.org | Akamai Technologies, Inc. | US | suspicious |
3720 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3684 | iexplore.exe | 167.172.125.12:443 | software-download.name | — | GB | unknown |
3684 | iexplore.exe | 184.24.77.79:80 | r3.o.lencr.org | Time Warner Cable Internet LLC | US | suspicious |
3684 | iexplore.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
software-download.name |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |