URL: | http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip |
Full analysis: | https://app.any.run/tasks/6149641e-df53-485c-8056-39c5a9f0c3b7 |
Verdict: | Malicious activity |
Analysis date: | June 19, 2019, 11:18:06 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | 8E5EEC4D19DC46850F3AC3EDAF519D7B |
SHA1: | EE50C9771F8A9F24D793814A5FBA89726FC58D71 |
SHA256: | CC84210F35F467CDAF5830301A58F4CD105080AFD98FB271940F34F5D83C3A1D |
SSDEEP: | 3:N1KJS4JsRx/YkzLqrSkzLqqc:Cc4JGxNqrXqv |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3172 | "C:\Program Files\Opera\opera.exe" http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip | C:\Program Files\Opera\opera.exe | explorer.exe | |
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Version: 1748 | ||||
1712 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\GetLocalAdminsGUI.zip" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3244 | "C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe" | C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe | explorer.exe | |
User: admin Company: Cjwdev Integrity Level: MEDIUM Description: This installer database contains the logic and data required to install Get Local Admins GUI. Version: 2.4.0 | ||||
1000 | /i "C:\Users\admin\AppData\Roaming\Cjwdev\Get Local Admins GUI 2.4.0\install\GetLocalAdminsGUISetup.msi" AI_SETUPEXEPATH="C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe" SETUPEXEDIR="C:\Users\admin\Desktop\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs " | C:\Windows\system32\msiexec.exe | GetLocalAdminsGUISetup.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3880 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
1452 | C:\Windows\system32\MsiExec.exe -Embedding 71A7208EA3B72749C91C2EF4F3A4A1D9 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2084 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3632 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000003C4" "00000334" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprFFF8.tmp | — | |
MD5:— | SHA256:— | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr9.tmp | — | |
MD5:— | SHA256:— | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr96.tmp | — | |
MD5:— | SHA256:— | |||
3172 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00002.tmp | — | |
MD5:— | SHA256:— | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1U3CHPV1GMFESNWWK4UJ.temp | — | |
MD5:— | SHA256:— | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:5BDC4A873BF44302FE081B30247102F1 | SHA256:DA890B951306F1B98A5A359C777BA3C624BB9D06966AB2E357C49F1D7054DA1D | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:2A5E48E98F685FC8080903FFF02B3D21 | SHA256:517C650F6B9E17F6C275DE2ECAA76244EC9B7A0E4C287588938674ACB798228B | |||
3172 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\g_0000\opr00001.tmp | compressed | |
MD5:00F64C054629CD44F322449E7C0AB559 | SHA256:E30E571DDE7ED8C267605EEA968DC786CD77523334CEB286A2BD61DB557AE5C5 | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:FFA86434295A8E2E2B3F5596D375415D | SHA256:5B7F1E91606592DB0FBF85BAB27F0EBEB30B95444C969D631B2BE0F0521FCD22 | |||
3172 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opr5E67.tmp | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3172 | opera.exe | GET | — | 94.136.40.103:80 | http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip | GB | — | — | malicious |
3172 | opera.exe | GET | 200 | 94.136.40.103:80 | http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip | GB | compressed | 2.25 Mb | malicious |
— | — | GET | 200 | 93.184.220.29:80 | http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl | US | der | 543 b | whitelisted |
3172 | opera.exe | GET | 400 | 185.26.182.112:80 | http://sitecheck2.opera.com/?host=www.cjwdev.com&hdn=05mLfJNc6XRzsqaL0iwXXg== | unknown | html | 150 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3172 | opera.exe | 185.26.182.112:80 | sitecheck2.opera.com | Opera Software AS | — | malicious |
3172 | opera.exe | 185.26.182.93:443 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
— | — | 93.184.220.29:80 | crl4.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3172 | opera.exe | 94.136.40.103:80 | www.cjwdev.com | Host Europe GmbH | GB | malicious |
Domain | IP | Reputation |
---|---|---|
www.cjwdev.com |
| malicious |
sitecheck2.opera.com |
| whitelisted |
certs.opera.com |
| whitelisted |
crl4.digicert.com |
| whitelisted |