File name: | ILPUnpack-1.0.0.zip |
Full analysis: | https://app.any.run/tasks/450fec21-41c7-4695-87ec-de7f31b73ef6 |
Verdict: | Malicious activity |
Analysis date: | August 08, 2020, 13:25:11 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 022C0F1EB1ED6A1A2C986ADFE38CF42E |
SHA1: | 8A0C6386713B7F7D1FD05059BE9AAA8DAC9AEE98 |
SHA256: | B1B4D679739AE79A6808D4C01EBEC6F2520FA688C67AA8C42F3EC3DD65F93D0C |
SSDEEP: | 49152:w5m5kGAQ6A/C3fsdPyj+3MfAldmJTfFnJG+b3:80AxUmfs5O+3wQmJpjb3 |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | ILPUnpack-1.0.0/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2020:08:08 15:11:27 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2744 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
888 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3948 | "C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net45\ILPUnpack.exe" | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net45\ILPUnpack.exe | — | explorer.exe |
User: admin Company: ElektroKill Integrity Level: MEDIUM Description: ILPUnpack Exit code: 1 Version: 1.0.0.0 |
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\137\52C64B7E |
Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0.zip | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2744) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\README.txt | text | |
MD5:9EC58FFA218BDC63D6E1EDFB3756133F | SHA256:A77EC0DDF7F8E236A0DFE27AF670CAF971D1E06BC304DF919BBE6966925F3B29 | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net45\ILPUnpack.exe | executable | |
MD5:2C71F7F0990B2701FBBEAB43002E10CD | SHA256:598020FB5B48016CA929F5FB5021C2181EADB3F57CAE7C1D634B198574A0BBE4 | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net35\MemeVMRT.dll | executable | |
MD5:E846B277C890EE20C86188E868E827A5 | SHA256:D19FF0BB66F6B769E66117911F43ADA1BD555508FDE04AB9B83DF909957381E9 | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net45\MemeVMRT.dll | executable | |
MD5:F8FFC239D215B1FE932339B49B1BE7CC | SHA256:ADC3C16D46703269C21E59F5586102D1634A296608FF1CE6E96E1B39B6FC602F | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net35\ILPUnpack.exe | executable | |
MD5:B3112C88A3574C7F0C7A72A3E1A4A6AD | SHA256:768FBB55C356840AE2DE0DE57755E4BB9E709E7E5265AC1C539432E5DA54B39F | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net45\ILPUnpack.exe.config | xml | |
MD5:DA07C2AF754C1B46C1F46BEB4A5CD5C9 | SHA256:60FDA282BBC1AEB836B158DD6DDE523E5225B365CC6FC0338DAB9E82347B1E2D | |||
2744 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\ILPUnpack-1.0.0\ILPUnpack-1.0.0\net35\ILPUnpack.exe.config | xml | |
MD5:752823B5C7C273595E81A199E416A357 | SHA256:4E863BFC83DDEACB18AFAB21DB653620F03037A62F864B6E44F8FE8AB180AEF4 |