File name: | Account_Tool_Exotic.rar |
Full analysis: | https://app.any.run/tasks/0d7b7c46-b0f1-4e0c-85bd-020841fd0e04 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 00:07:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | C70F51E0DE5DDFF3BE3AB1D208FF7042 |
SHA1: | F1814CB7E5CC5A99CA5D773B619BF41D5EBBE4DE |
SHA256: | CFDA3C8121BE164CDCF43766499D23349FFCD56C59AB98056B7838FCF44DD790 |
SSDEEP: | 196608:yphSKKxset5Th0d+IZDToLO4SwpT7HOeML/mhJJp/XKw1pUq43zRqQpZ:shesetNSZBULO4SwMeImJJdT1n4Zf |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2552 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Account_Tool_Exotic.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 | ||||
4076 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
3484 | "C:\Users\admin\Desktop\Account Generator v8.1.2.exe" | C:\Users\admin\Desktop\Account Generator v8.1.2.exe | — | Explorer.EXE |
User: admin Integrity Level: MEDIUM Description: Loader Exit code: 3221226540 Version: 1.0.0.0 | ||||
2364 | "C:\Users\admin\Desktop\Account Generator v8.1.2.exe" | C:\Users\admin\Desktop\Account Generator v8.1.2.exe | Explorer.EXE | |
User: admin Integrity Level: HIGH Description: Loader Exit code: 0 Version: 1.0.0.0 | ||||
3120 | "C:\Windows\System32\cmd.exe" /k CLOSE NOW! | C:\Windows\System32\cmd.exe | — | Account Generator v8.1.2.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2552.11569\Account Generator v8.1.2.exe | executable | |
MD5:F64074E976A8C2AE13ED0BA8D8241F69 | SHA256:C8A84983381B87E5E738E03498844B5A2BE127343B78F9E9D511F183985779F7 | |||
2552 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2552.11900\Siticone.UI.dll | executable | |
MD5:750C58AF2E56B6ADDECFFCF152520AB8 | SHA256:27C56A28CBDE094157206DA1BFCD7A395111AB97B8A5FF600B11C2175DCEFB26 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2364 | Account Generator v8.1.2.exe | 188.114.96.3:443 | keyauth.win | CLOUDFLARENET | NL | malicious |
Domain | IP | Reputation |
---|---|---|
keyauth.win |
| malicious |