download: | PerxCore_Release.rar |
Full analysis: | https://app.any.run/tasks/c75645d0-6497-4b68-8eff-34f15c4db5ec |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 08:28:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | DC43A6C8E3CC85B7C7A1AFB4028D8ACF |
SHA1: | 100F217A015E522B65B72975208D567AEAABA3EC |
SHA256: | B17924E212DC44627575A991D495A453CE2CD72385CF4A4B6C71C8F13C4A8760 |
SSDEEP: | 393216:llxP6EdwEhJZQw3mBIxIgslX3J/yp79us08omdMdJrIsX9uATWbUegM3WtpzWf:Xd3hkHBTfJ/ypBJrs/WSDWf |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2900 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PerxCore_Release.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
680 | "C:\Users\admin\Desktop\PerXCore 2.0.exe" | C:\Users\admin\Desktop\PerXCore 2.0.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
2240 | "C:\Users\admin\Desktop\PerXCore 2.0.exe" | C:\Users\admin\Desktop\PerXCore 2.0.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 3221225547 | ||||
2500 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
116 | "C:\Users\admin\Desktop\PerXCore 2.0.exe" | C:\Users\admin\Desktop\PerXCore 2.0.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
3772 | "C:\Users\admin\Desktop\PerXCore 2.0.exe" | C:\Users\admin\Desktop\PerXCore 2.0.exe | explorer.exe | |
User: admin Integrity Level: HIGH Exit code: 3221225547 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2900 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2900.35365\PerXCore 2.0.exe | executable | |
MD5:BA068272C40250646CD55DFC5EF8E08E | SHA256:2419306638FC922F03F2CE2F22BCD4B5B95F21F44A61E78B23C3CF8181BF0F3C | |||
2900 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2900.35365\platforms\qwindows.dll | executable | |
MD5:177EA1230AAD45B05E9374CCD0541855 | SHA256:A3D473887826A4513D49CF7F2CD5B110AEC0F3214CCDF5776822ECA431B62FCE |