File name: | 1C - плaтежноe пopучeнние №34729636725 - 2019.rar |
Full analysis: | https://app.any.run/tasks/1f61fac1-9446-48d2-9ff2-8ef82f199cc5 |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 03:33:55 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, flags: EncryptedBlockHeader |
MD5: | A2181138EEEC6D9AFB066F1BB325CA01 |
SHA1: | 37D2EA8FBECA59207AFEEB751439D7195F1F0B5E |
SHA256: | CE0A72B4A1A6E4F4BBB0EAFCE37932F90AC3642DD2B28E26CA4A88079DE8C0FF |
SSDEEP: | 24576:BsFQ5kUFvn7k5jWbMU4XrIUAlZF7UAmgUMBp3nEHqNHoAZFr:VVKjWbMxrJAlzwAmkEKNIAr |
.rar | | | RAR compressed archive (v-4.x) (58.3) |
---|---|---|
.rar | | | RAR compressed archive (gen) (41.6) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3088 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1C - плaтежноe пopучeнние №34729636725 - 2019.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3920 | "C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.41167\1C - плaтежноe пopучeнние №34729636725 - 2019.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.41167\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | — | WinRAR.exe |
User: admin Company: 73443316.523404.8564521 Integrity Level: MEDIUM Description: 128.7502.94331.2341 4643220.234259.2342341.234236 Installati Exit code: 3221226540 Version: 4643220.234259.23423 | ||||
2760 | "C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.41167\1C - плaтежноe пopучeнние №34729636725 - 2019.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.41167\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | WinRAR.exe | |
User: admin Company: 73443316.523404.8564521 Integrity Level: HIGH Description: 128.7502.94331.2341 4643220.234259.2342341.234236 Installati Exit code: 0 Version: 4643220.234259.23423 | ||||
2124 | "C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.44333\1C - плaтежноe пopучeнние №34729636725 - 2019.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.44333\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | — | WinRAR.exe |
User: admin Company: 73443316.523404.8564521 Integrity Level: MEDIUM Description: 128.7502.94331.2341 4643220.234259.2342341.234236 Installati Exit code: 3221226540 Version: 4643220.234259.23423 | ||||
2736 | "C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.44333\1C - плaтежноe пopучeнние №34729636725 - 2019.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.44333\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | WinRAR.exe | |
User: admin Company: 73443316.523404.8564521 Integrity Level: HIGH Description: 128.7502.94331.2341 4643220.234259.2342341.234236 Installati Exit code: 0 Version: 4643220.234259.23423 |
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\1C - плaтежноe пopучeнние №34729636725 - 2019.rar | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3088) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths |
Operation: | write | Name: | name |
Value: 120 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.44333\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | executable | |
MD5:ED8029C038BAD9583DDE1D113D0F1FDD | SHA256:CDDE95F4DA79994A9613B0901350A4B8C6148B437CCE9F8BD395E3CD79C05ADF | |||
3088 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb3088.41167\1C - плaтежноe пopучeнние №34729636725 - 2019.scr | executable | |
MD5:ED8029C038BAD9583DDE1D113D0F1FDD | SHA256:CDDE95F4DA79994A9613B0901350A4B8C6148B437CCE9F8BD395E3CD79C05ADF |