download: | newupdate_password_2227.zip |
Full analysis: | https://app.any.run/tasks/74cfd549-dc9c-40de-bd44-9a56cb191a85 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 17:34:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 902E6FEBB705BE9D5A81E80191C5256A |
SHA1: | 70097464419F45EDB280199E068B52158D724DCE |
SHA256: | C299E07C1A2FD29A21C075A5467F1AF42ECE26452B1607F76EA6E500D69B77E7 |
SSDEEP: | 98304:3fioND+IQgyWaU0bn3Phved6/MJdCLglwZ5l2wAjhK8O:qSfQbWaU43JevJdd42wA9c |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | icuin56.dll |
---|---|
ZipUncompressedSize: | 1786368 |
ZipCompressedSize: | 625601 |
ZipCRC: | 0x504a8449 |
ZipModifyDate: | 2022:01:24 02:15:04 |
ZipCompression: | Unknown (99) |
ZipBitFlag: | 0x0009 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2824 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\newupdate_password_2227.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
3492 | "C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\version_v317.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\version_v317.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
3592 | "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | version_v317.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET ClickOnce Launch Utility Exit code: 2148734499 Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
| |||||||||||||||
3112 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\accessibility.xpt | xpt | |
MD5:1E178B64020F1CE4D8518C5B18B208A0 | SHA256:A560EC424A3CAED79CB93049DE888A3843BC34F352B6BB27F10724E10AB690DB | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\addoncompat.manifest | text | |
MD5:5693979E6BD243F503621BD8A3E1076A | SHA256:414E9DB8B02035B3CDCE8C26D7360C5E92AFBE1D9588900B6E8DD1D141CCA258 | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\ActivityRequestHandler.js | text | |
MD5:7E6626AEF21B0DB6878A1AAFD28D3D7E | SHA256:95C59A66FBC28D9B13645B9B2CE656D4721272FF8D67E1177201504E059B41E4 | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\ActivityProxy.js | text | |
MD5:18B159534F17E4ECFE583D0D9BB5DC40 | SHA256:72D64C65530EA288072661271A0ABB3CFB56349CCC50B06C711641709D5581B7 | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\ActivityMessageConfigurator.js | text | |
MD5:AA156D59F227CCDB14D7E57610EA4E09 | SHA256:5EB82F1263629746E167ED91B3C12D51AAE1408F62F405170A8943759D15F525 | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\amContentHandler.js | text | |
MD5:24B4A2E9F7AEEC416ADCC5417B9E1D23 | SHA256:BCC9CFE21D5AFFB8F38AFF6DA5A8809AF1E5F0A0C4689224DF50E1FD849548ED | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\ActivityWrapper.js | text | |
MD5:5B7E48E5EBB0312591F7AC2843BA4E8E | SHA256:FE510D8FC2EA30C085010E158067A26ABB31A0616E2BC7D48FDF374AF8E66D3D | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\AlarmsManager.js | text | |
MD5:424A1C9971BE1F1C4DCE01076281E07D | SHA256:CE3A0C14B6148E58EC396922D6FEAC1E1D3112C241B82315791A5424C489AEA2 | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\alerts.xpt | xpt | |
MD5:B59FE9DE24E191FDAC192964A54C46D5 | SHA256:883F55272F1342193F295826EAFB3D67B047BA1372494F2D63B0C811BC01808B | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb2824.48787\components\addonManager.js | text | |
MD5:FEE4AAB83B139A9F171DDFA27ADDDC90 | SHA256:F4E3BD9E64163E9F45C9219C728C47BF11EA6F7DE50D92EA6B66F8D8648F9804 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3592 | AppLaunch.exe | POST | 200 | 185.220.35.84:5002 | http://185.220.35.84:5002/uploadfile | RU | text | 7 b | malicious |
3592 | AppLaunch.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json | unknown | binary | 301 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3592 | AppLaunch.exe | 185.220.35.84:5002 | — | LLC Vpsville | RU | malicious |
3592 | AppLaunch.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | malicious |
Domain | IP | Reputation |
---|---|---|
ip-api.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3592 | AppLaunch.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
3592 | AppLaunch.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup ip-api.com |
3592 | AppLaunch.exe | A Network Trojan was detected | ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) |
3592 | AppLaunch.exe | A Network Trojan was detected | ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2 |
3592 | AppLaunch.exe | A Network Trojan was detected | ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2 |
3592 | AppLaunch.exe | A Network Trojan was detected | ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt) |
Process | Message |
---|---|
AppLaunch.exe | CLR: Managed code called FailFast without specifying a reason.
|
AppLaunch.exe | CLR: Managed code called FailFast without specifying a reason.
|