File name: | Account_Tool_Exotic.rar |
Full analysis: | https://app.any.run/tasks/42444cbb-b107-492b-8de1-4db0561bfd09 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 00:03:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | C70F51E0DE5DDFF3BE3AB1D208FF7042 |
SHA1: | F1814CB7E5CC5A99CA5D773B619BF41D5EBBE4DE |
SHA256: | CFDA3C8121BE164CDCF43766499D23349FFCD56C59AB98056B7838FCF44DD790 |
SSDEEP: | 196608:yphSKKxset5Th0d+IZDToLO4SwpT7HOeML/mhJJp/XKw1pUq43zRqQpZ:shesetNSZBULO4SwMeImJJdT1n4Zf |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1076 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Account_Tool_Exotic.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
2508 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Account Generator v8.1.2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Account Generator v8.1.2.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Loader Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
1500 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Account Generator v8.1.2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Account Generator v8.1.2.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Loader Version: 1.0.0.0 Modules
| |||||||||||||||
3468 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Account Generator v8.1.2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Account Generator v8.1.2.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Loader Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
3488 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Account Generator v8.1.2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Account Generator v8.1.2.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Loader Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
2864 | "C:\Windows\System32\cmd.exe" /k CLOSE NOW! | C:\Windows\System32\cmd.exe | — | Account Generator v8.1.2.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 3221225786 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3936 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
2836 | "C:\Users\admin\Desktop\Account Generator v8.1.2.exe" | C:\Users\admin\Desktop\Account Generator v8.1.2.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Loader Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
3844 | "C:\Users\admin\Desktop\Account Generator v8.1.2.exe" | C:\Users\admin\Desktop\Account Generator v8.1.2.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Description: Loader Version: 1.0.0.0 Modules
| |||||||||||||||
3788 | "C:\Windows\System32\cmd.exe" /k CLOSE NOW! | C:\Windows\System32\cmd.exe | — | Account Generator v8.1.2.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1076.40650\Account Generator v8.1.2.exe | executable | |
MD5:F64074E976A8C2AE13ED0BA8D8241F69 | SHA256:C8A84983381B87E5E738E03498844B5A2BE127343B78F9E9D511F183985779F7 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Account Generator v8.1.2.exe | executable | |
MD5:F64074E976A8C2AE13ED0BA8D8241F69 | SHA256:C8A84983381B87E5E738E03498844B5A2BE127343B78F9E9D511F183985779F7 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Account Generator v8.1.2.exe | executable | |
MD5:F64074E976A8C2AE13ED0BA8D8241F69 | SHA256:C8A84983381B87E5E738E03498844B5A2BE127343B78F9E9D511F183985779F7 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37159\Siticone.UI.dll | executable | |
MD5:750C58AF2E56B6ADDECFFCF152520AB8 | SHA256:27C56A28CBDE094157206DA1BFCD7A395111AB97B8A5FF600B11C2175DCEFB26 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1076.37300\Siticone.UI.dll | executable | |
MD5:750C58AF2E56B6ADDECFFCF152520AB8 | SHA256:27C56A28CBDE094157206DA1BFCD7A395111AB97B8A5FF600B11C2175DCEFB26 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa1076.39131\Siticone.UI.dll | executable | |
MD5:750C58AF2E56B6ADDECFFCF152520AB8 | SHA256:27C56A28CBDE094157206DA1BFCD7A395111AB97B8A5FF600B11C2175DCEFB26 | |||
1076 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1076.40129\Siticone.UI.dll | executable | |
MD5:750C58AF2E56B6ADDECFFCF152520AB8 | SHA256:27C56A28CBDE094157206DA1BFCD7A395111AB97B8A5FF600B11C2175DCEFB26 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3488 | Account Generator v8.1.2.exe | 188.114.96.3:443 | keyauth.win | CLOUDFLARENET | NL | malicious |
3844 | Account Generator v8.1.2.exe | 188.114.96.3:443 | keyauth.win | CLOUDFLARENET | NL | malicious |
Domain | IP | Reputation |
---|---|---|
keyauth.win |
| malicious |