download: | file |
Full analysis: | https://app.any.run/tasks/c5bf5034-642a-44b2-b682-06cedaf3bbea |
Verdict: | Malicious activity |
Analysis date: | October 20, 2020, 06:47:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | 8EECBBD6B6438A851F86E2D481384AA4 |
SHA1: | 9DA39E2A5AC7FCA6C2AF009B4F840A2C4B017AAA |
SHA256: | D27659880120ED1DFF975F2AD2D55570222AE66F1CB3F889585B543B9A1CDC81 |
SSDEEP: | 6144:6Rj+yfIzx3qXoYOXGrtI1Iz1PNGy1ItF4xOfZXcscIuycwbcqy8v3cqHga8f38FN:6DfI9SO2C1IRNT1+tKcbl3VV8f38SuLJ |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2504 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\file.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
532 | "C:\Users\admin\Desktop\TNT Tracking.exe" | C:\Users\admin\Desktop\TNT Tracking.exe | explorer.exe | |
User: admin Company: 0h<b&3^2z6 Integrity Level: MEDIUM Description: t]12p#>8mp~43t_?0v Exit code: 0 Version: 5.7.10.12 | ||||
832 | "C:\Users\admin\AppData\Local\Temp\InstallUtil.exe" | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | TNT Tracking.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Version: 4.7.3062.0 built by: NET472REL1 |
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\file.7z | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2504) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (532) TNT Tracking.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (532) TNT Tracking.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2504 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2504.32209\TNT Tracking.exe | — | |
MD5:— | SHA256:— | |||
532 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | executable | |
MD5:91C9AE9C9A17A9DB5E08B120E668C74C | SHA256:E56A7E5D3AB9675555E2897FC3FAA2DD9265008A4967A7D54030AB8184D2D38F | |||
532 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\d5826601-c1fb-4502-b6a6-7bd4388c1d4b\Xxl.dll | executable | |
MD5:14FF402962AD21B78AE0B4C43CD1F194 | SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B | |||
532 | TNT Tracking.exe | C:\Users\admin\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dll | executable | |
MD5:14FF402962AD21B78AE0B4C43CD1F194 | SHA256:FB9646CB956945BDC503E69645F6B5316D3826B780D3C36738D6B944E884D15B |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
832 | InstallUtil.exe | 212.227.15.142:587 | smtp.1and1.es | 1&1 Internet SE | DE | suspicious |
Domain | IP | Reputation |
---|---|---|
smtp.1and1.es |
| shared |
PID | Process | Class | Message |
---|---|---|---|
832 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |