File name: | Kraken_2.0.7.bin.zip |
Full analysis: | https://app.any.run/tasks/e15f7e03-ae46-408d-8fdd-948a76d46877 |
Verdict: | Malicious activity |
Analysis date: | January 11, 2019, 12:56:23 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | EF7B7D51475809CEEA79B3D15EF69CD4 |
SHA1: | CD635363E39F5AA0B856A5754F41868C47E1225A |
SHA256: | E1D5B751199D7C78320CC4236FA7009C31BD5F2DFB64F8FF8F1174A3DB824989 |
SSDEEP: | 1536:XV+EV6vFa4jybAJZ7VupIcjmjLmzJj4Obc5DZ00OyJm:F+86NafbAJNVUIcbJj4PQL |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | hpwb62pa.bin |
---|---|
ZipUncompressedSize: | 147456 |
ZipCompressedSize: | 65576 |
ZipCRC: | 0xfca0cc84 |
ZipModifyDate: | 2018:10:21 11:35:24 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2968 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Kraken_2.0.7.bin.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3136 | "C:\Users\admin\Desktop\hpwb62pa.exe" | C:\Users\admin\Desktop\hpwb62pa.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: Kaspersky core Exit code: 3221226540 Version: 1.0.2.3 | ||||
3560 | "C:\Users\admin\Desktop\hpwb62pa.exe" | C:\Users\admin\Desktop\hpwb62pa.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: Kaspersky core Exit code: 3762507597 Version: 1.0.2.3 | ||||
2520 | dw20.exe -x -s 368 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe | — | hpwb62pa.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft .NET Error Reporting Shim Exit code: 0 Version: 2.0.50727.4927 (NetFXspW7.050727-4900) | ||||
3680 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3712 | "C:\Program Files\windows defender\MSASCui.exe" -quickscan | C:\Program Files\windows defender\MSASCui.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Defender User Interface Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3368 | "C:\Users\admin\Desktop\hpwb62pa.exe" | C:\Users\admin\Desktop\hpwb62pa.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: Kaspersky core Exit code: 3221226540 Version: 1.0.2.3 | ||||
2280 | "C:\Users\admin\Desktop\hpwb62pa.exe" | C:\Users\admin\Desktop\hpwb62pa.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: Kaspersky core Version: 1.0.2.3 | ||||
1832 | dw20.exe -x -s 364 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe | hpwb62pa.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft .NET Error Reporting Shim Version: 2.0.50727.4927 (NetFXspW7.050727-4900) |
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Kraken_2.0.7.bin.zip | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2968) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 | |||
(PID) Process: | — | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager |
Operation: | write | Name: | UsrColumnSettings |
Value: 1C0C0000340400000000000050000000010000001D0C0000350400000000000023000000010000001E0C000036040000000000003C000000010000001F0C000039040000000000004E00000001000000200C000037040000000000004E00000001000000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1832 | dw20.exe | C:\Users\admin\AppData\Local\Temp\WER4AEF.tmp.WERInternalMetadata.xml | xml | |
MD5:A41FDB618C72A759F8FA00428953D691 | SHA256:C4E16A296CE32A0ECDE3F63D6B60DC634AAE72E35A9CBB7867B0DB850F90E684 | |||
2520 | dw20.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_hpwb62pa.exe_65a570705d156a98cbee2cc12d8e219a31289ffd_09f9ef03\Report.wer | binary | |
MD5:66F453130C097545266E76F38CA54437 | SHA256:AC0907F47FA62D92CA5FA42B8274192AD4A8C93C142A5930292CFE49BE43A04E | |||
2968 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2968.41416\hpwb62pa.bin | executable | |
MD5:BCD2A924EE16F3A2ED4B77D0C09FC3A0 | SHA256:B639E26A0F0354515870EE167AE46FDD9698C2F0D405AD8838E2E024EB282E39 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1832 | dw20.exe | GET | — | 40.67.186.102:80 | http://watson.microsoft.com/StageOne/hpwb62pa_exe/1_0_2_3/5bcc36e6/KERNELBASE_dll/6_1_7601_17514/4ce7b8f0/e0434f4d/0000b760.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.48.17514&SM=DELL&SPN=DELL&BV=DELL&MID=3ADE2C42-4AB9-49B7-B142-BE9AEEA69063 | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1832 | dw20.exe | 40.67.186.102:80 | watson.microsoft.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
watson.microsoft.com |
| whitelisted |