File name: | Total Antivirus 2022.zip |
Full analysis: | https://app.any.run/tasks/f1d33629-5020-4c9e-9ac5-54041593fa63 |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 18:14:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 539955D9901969D50CC0EB2D51F40511 |
SHA1: | A03AC7698D8D48E1E568CFC3AB70F138557F0FB0 |
SHA256: | DB58CF1591969E9E93988F0E4FE065DFC951B5FBCF2C45EF3C81C679A00D6D44 |
SSDEEP: | 196608:WOndg/nVzqdhOndg/nVzqdx2Q4krjz6f3W0UAdhzWX7:WOnW/sOnW/m2nPUAO |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Total Antivirus 2022/.vs/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2022:01:09 10:19:06 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3732 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Total Antivirus 2022.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
3796 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
1396 | "C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\bin\Debug\Total Antivirus 2022.exe" | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\bin\Debug\Total Antivirus 2022.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Total Antivirus 2022 Exit code: 2148734720 Version: 1.0.0.0 Modules
| |||||||||||||||
2896 | "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=Total Antivirus 2022.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209 | C:\Program Files\Internet Explorer\iexplore.exe | Total Antivirus 2022.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
1392 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2896 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Total Antivirus 2022.zip | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3732) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\.vs\Total Antivirus 2022\v16\.suo | binary | |
MD5:7277A756124FB041355B12E05E5DC753 | SHA256:71810EB3FBC0BB871C93D905C6D4826FD4FE7BD37DF72794AE04B0A7BDFE60F2 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\Form1 - Copy.resx | xml | |
MD5:E4AFCE96D7FC5646D5C37A170B482472 | SHA256:85DB8A204AF15364F2D1AC64F5079EAC2B448B43FBCCF42FDAA15915B42975E7 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\Form1 - Copy.cs | text | |
MD5:24477412506DF9622CA32D260106F459 | SHA256:1D4420BD7AB8A63680DF490D64F9B4A0D727D28FCEA651AEF7883BEE77C3BB2F | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022.exe.lnk | lnk | |
MD5:6B41E9B3B12D6F0577BDFB73AE0C4944 | SHA256:508CA90D8C6DC91F01D527635DD06244A2FBB331E460C837883CD7BEA8A84929 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\MigrationBackup\2bd9835f\Total Antivirus 2022\NuGetUpgradeLog.html | html | |
MD5:0C2ED717D4F15F9657123FE6AF61A7D7 | SHA256:7A3596EED0D3B99AC3E4C2D501A9D0A027A407207B7DF05D44B104329BB8EFF9 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\MigrationBackup\2bd9835f\Total Antivirus 2022\Total Antivirus 2022.csproj | xml | |
MD5:2BC15D7C4A353E49053EC5623E9F97D2 | SHA256:3A2915FCF36C393333640EB9E40FE7354361E40332A447B3598A8C0F05CAF342 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022.sln | text | |
MD5:F94E7085E2BCF18BA67B4B32344CD098 | SHA256:EA7367AC1F027C262CE91A001C2CE0E83D8DD8F6BFDF363A7BB9FD73EDA50BC0 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\Form1.Designer.cs | text | |
MD5:85CEBCA1908CDB3FDF748DFBA2BC4E90 | SHA256:BF9DF566A35313128CF614F056AB8842A05CDB004BAFEB8BBDF440A38CB9CD7C | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\bin\Debug\Total Antivirus 2022.exe | executable | |
MD5:6CEEF7B1F2DAE535A8B9677B8A427C41 | SHA256:76D4068BA64EF581C444DA08DDEB7FCC85F18C69029A8F706A6CED4E098DC992 | |||
3732 | WinRAR.exe | C:\Users\admin\Desktop\Total Antivirus 2022\Total Antivirus 2022\Cornmanthe3rd-Plex-Utilities-antivirus.ico | image | |
MD5:961952E205D45CC14020BD862D683733 | SHA256:3753A625FDEEEE5D7CC577CCF4896AE7726A0031D858EBD31BCC762C8D309D4C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D | US | der | 471 b | whitelisted |
1392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
1392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2896 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?55464065e2b7772f | US | compressed | 4.70 Kb | whitelisted |
2896 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?11bdccebefff8b49 | US | compressed | 4.70 Kb | whitelisted |
1392 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f88a1d0699515edd | US | compressed | 4.70 Kb | whitelisted |
2896 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/Omniroot2025.crl | US | der | 7.68 Kb | whitelisted |
1392 | iexplore.exe | GET | 200 | 13.107.4.50:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ddf3d830780be486 | US | compressed | 4.70 Kb | whitelisted |
1392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D | US | der | 1.47 Kb | whitelisted |
1392 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1392 | iexplore.exe | 104.111.242.51:443 | go.microsoft.com | Akamai International B.V. | NL | unknown |
2896 | iexplore.exe | 131.253.33.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
1392 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2896 | iexplore.exe | 13.107.4.50:80 | ctldl.windowsupdate.com | Microsoft Corporation | US | whitelisted |
1392 | iexplore.exe | 13.107.4.50:80 | ctldl.windowsupdate.com | Microsoft Corporation | US | whitelisted |
2896 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1392 | iexplore.exe | 13.107.246.44:443 | dotnet.microsoft.com | Microsoft Corporation | US | suspicious |
1392 | iexplore.exe | 13.69.106.89:443 | dc.services.visualstudio.com | Microsoft Corporation | NL | unknown |
1392 | iexplore.exe | 2.18.233.62:443 | www.microsoft.com | Akamai International B.V. | — | whitelisted |
— | — | 13.69.106.89:443 | dc.services.visualstudio.com | Microsoft Corporation | NL | unknown |
Domain | IP | Reputation |
---|---|---|
go.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
dotnet.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
statics-marketingsites-wcus-ms-com.akamaized.net |
| whitelisted |
img-prod-cms-rt-microsoft-com.akamaized.net |
| whitelisted |
az416426.vo.msecnd.net |
| whitelisted |