| File name: | пиздилка.rar |
| Full analysis: | https://app.any.run/tasks/4f0a03fe-a178-4903-a59d-e91c4c393a5f |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | May 19, 2019, 14:41:43 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | 3AD35F9812FE3566408E3AD3B5F6BEF8 |
| SHA1: | 34B34E194D5C5FEFE12BF53C1309FE313D811E17 |
| SHA256: | CC1A311DCD7618EB9985F95DF2C736BFA8DECC772A2C324C1FF53AC290770830 |
| SSDEEP: | 12288:SChq7jM68qwMNgiFuc/ShGGPGjNf7v2NzuOrBJi4uim40j:7hq740KPc/0zPGYZDi4uimH |
MALICIOUS
Application was dropped or rewritten from another process
- ProduKey.exe (PID: 3252)
- Web.exe (PID: 3136)
- Chrome.exe (PID: 392)
- Chrome.exe (PID: 2848)
- Fox.exe (PID: 2604)
Stealing of credential data
- Chrome.exe (PID: 392)
- Web.exe (PID: 3136)
Actions looks like stealing of personal data
- Web.exe (PID: 3136)
SUSPICIOUS
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3144)
Loads DLL from Mozilla Firefox
- Fox.exe (PID: 2604)
- Web.exe (PID: 3136)
INFO
Manual execution by user
- cmd.exe (PID: 1492)
- NOTEPAD.EXE (PID: 3804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 222 |
|---|---|
| UncompressedSize: | 313 |
| OperatingSystem: | Win32 |
| ModifyDate: | 2019:05:10 12:25:12 |
| PackingMethod: | Normal |
| ArchivedFileName: | ????????\1)Spizdil.bat |
Total processes
44
Monitored processes
8
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 392 | Chrome.exe /stext spizjennoe/8)Chrome.txt | C:\Users\admin\Desktop\Chrome.exe | cmd.exe | ||||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: ChromePass Exit code: 0 Version: 1.20 Modules
| |||||||||||||||
| 1492 | cmd /c ""C:\Users\admin\Desktop\1)Spizdil.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2604 | Fox.exe /stext spizjennoe/4)Fox.txt | C:\Users\admin\Desktop\Fox.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: PasswordFox Exit code: 0 Version: 1.31 Modules
| |||||||||||||||
| 2848 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\Chrome.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\Chrome.exe | — | WinRAR.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: ChromePass Exit code: 0 Version: 1.20 Modules
| |||||||||||||||
| 3136 | Web.exe /stext spizjennoe/2)Web.txt | C:\Users\admin\Desktop\Web.exe | cmd.exe | ||||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: WebBrowserPassView Exit code: 0 Version: 1.26 Modules
| |||||||||||||||
| 3144 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\пиздилка.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3252 | ProduKey.exe /stext spizjennoe/5)ProduKey.txt | C:\Users\admin\Desktop\ProduKey.exe | — | cmd.exe | |||||||||||
User: admin Company: NirSoft Integrity Level: MEDIUM Description: ProduKey Exit code: 0 Version: 1.53 Modules
| |||||||||||||||
| 3804 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\spizjennoe\2)Web.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
554
Read events
518
Write events
36
Delete events
0
Modification events
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\пиздилка.rar | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | @C:\Windows\System32\acppage.dll,-6002 |
Value: Windows Batch File | |||
| (PID) Process: | (3144) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
Executable files
12
Suspicious files
2
Text files
15
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\__rar_3144.1657 | — | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\WirelessKeyView.exe | executable | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\1)Spizdil.bat | text | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\Chrome.exe | executable | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\123\Новый текстовый документ.txt | text | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\пиздилка.bak3144.1667 | compressed | |
MD5:— | SHA256:— | |||
| 2848 | Chrome.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3144.44857\пиздилка\Chrome.cfg | text | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3144.2423\пиздилка\1)Spizdil.bat | text | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3144.2423\пиздилка\123\Новый текстовый документ.txt | text | |
MD5:— | SHA256:— | |||
| 3144 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3144.2423\пиздилка\Chrome.exe | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report