File name: | 8c05c488df3cd58076d2.zip |
Full analysis: | https://app.any.run/tasks/45bff903-5157-4eeb-b1dc-402f38738f90 |
Verdict: | Malicious activity |
Analysis date: | November 08, 2019, 15:36:08 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 9C8EAA4A5ED16413C9F1CB6225B3C367 |
SHA1: | A37C1796105FBB21F8143EC105CC98753AE23743 |
SHA256: | E1CBA0FD007C4B0A8A511BC63DBFECEEFA361A3CF512FC2CC2D653940A09DA25 |
SSDEEP: | 6144:wgePfyB65p2EYMRaV57djflRSG+huygRzAiqPTViTQ7GDnhlXI+aStFGXeXL0nvx:+aw5cEYmaL5DSG4fJPTVH7GDXXzaSGXD |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | 8c05c488df3cd58076d225399fb13e2a070c72e20b915bb056e4b750f5b99255.bin |
---|---|
ZipUncompressedSize: | 373728 |
ZipCompressedSize: | 373728 |
ZipCRC: | 0x9898ad71 |
ZipModifyDate: | 2019:11:08 15:32:17 |
ZipCompression: | None |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1556 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\8c05c488df3cd58076d2.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2184 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3780 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\system32\ntvdm.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3256 | "C:\Windows\system32\ntvdm.exe" -i2 | C:\Windows\system32\ntvdm.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3724 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\8c05c488df3cd58076d2\8c05c488df3cd58076d225399fb13e2a070c72e20b915bb056e4b750f5b99255.rar" C:\Users\admin\Downloads\8c05c488df3cd58076d2\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2140 | "C:\Users\admin\Downloads\8c05c488df3cd58076d2\PAYMENT $87950.exe" | C:\Users\admin\Downloads\8c05c488df3cd58076d2\PAYMENT $87950.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.07.0009 | ||||
3172 | "C:\Users\admin\Downloads\8c05c488df3cd58076d2\PAYMENT $87950.exe" | C:\Users\admin\Downloads\8c05c488df3cd58076d2\PAYMENT $87950.exe | PAYMENT $87950.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.07.0009 | ||||
2444 | "C:\Users\admin\AppData\Roaming\Install\Host.exe" | C:\Users\admin\AppData\Roaming\Install\Host.exe | — | PAYMENT $87950.exe |
User: admin Integrity Level: MEDIUM Version: 1.07.0009 |
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\8c05c488df3cd58076d2.zip | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\8c05c488df3cd58076d2 | |||
(PID) Process: | (1556) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3780 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs7BFC.tmp | — | |
MD5:— | SHA256:— | |||
3780 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs7BFD.tmp | — | |
MD5:— | SHA256:— | |||
3256 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scsE11A.tmp | — | |
MD5:— | SHA256:— | |||
3256 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scsE11B.tmp | — | |
MD5:— | SHA256:— | |||
3724 | WinRAR.exe | C:\Users\admin\Downloads\8c05c488df3cd58076d2\PAYMENT $87950.exe | executable | |
MD5:B077165CBA04BD0D2170A495B6579B65 | SHA256:370A5C3410E458A615CD1B1581B90273BAC8DF37C602C83F9D2E4C85DEEB6278 | |||
3172 | PAYMENT $87950.exe | C:\Users\admin\AppData\Roaming\Install\Host.exe | executable | |
MD5:B077165CBA04BD0D2170A495B6579B65 | SHA256:370A5C3410E458A615CD1B1581B90273BAC8DF37C602C83F9D2E4C85DEEB6278 | |||
1556 | WinRAR.exe | C:\Users\admin\Downloads\8c05c488df3cd58076d2\8c05c488df3cd58076d225399fb13e2a070c72e20b915bb056e4b750f5b99255.bin | compressed | |
MD5:C7F020351F95CADB337335E25FF551A9 | SHA256:8C05C488DF3CD58076D225399FB13E2A070C72E20B915BB056E4B750F5B99255 |