File name: | a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp.zip |
Full analysis: | https://app.any.run/tasks/76d0afb4-947b-4c67-b7ac-ad3f4cdeca2c |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 06:43:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 86C63BF0B78E339AC9D56516309C8371 |
SHA1: | 5CDA1D0CB4C9D54EAD7FAB881C60ED0A1D4D9C0F |
SHA256: | E2114135CE2C57EB8D3509BF66CC781211927D61C96FD4BF849DB5D18805DA79 |
SSDEEP: | 384:MFXefz+cRq1lx9UY7QWInj6GcWBZ882KJc/dlwezKD:FY9fIj5Z8iJc/c |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp |
---|---|
ZipUncompressedSize: | 42496 |
ZipCompressedSize: | 18164 |
ZipCRC: | 0xd3eb8e35 |
ZipModifyDate: | 2022:05:21 06:43:09 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2952 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
2136 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.9435\a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp | C:\Windows\system32\rundll32.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1860 | "C:\Users\admin\Desktop\Synapse.exe" | C:\Users\admin\Desktop\Synapse.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
3168 | "C:\Users\admin\Desktop\Synapse.exe" | C:\Users\admin\Desktop\Synapse.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
3912 | "C:\Users\admin\Desktop\Synapse.exe" | C:\Users\admin\Desktop\Synapse.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
2252 | "C:\Users\admin\Desktop\Synapse.exe" | C:\Users\admin\Desktop\Synapse.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 Modules
| |||||||||||||||
2588 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Synapse.exe" | C:\Program Files\Notepad++\notepad++.exe | Explorer.EXE | ||||||||||||
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.91 Modules
|
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp.zip | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2952) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb2952.9435\a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp | executable | |
MD5:6212CF0D521F5B1996BAB838E5CE0C76 | SHA256:40911B9C3F63E6C455A8F669D96D208F5BB477FA8053271F54632AA5F3734F68 | |||
2952 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2952.10698\a6ad0a2c-30f5-453b-9c33-65120a9a7703.tmp | executable | |
MD5:6212CF0D521F5B1996BAB838E5CE0C76 | SHA256:40911B9C3F63E6C455A8F669D96D208F5BB477FA8053271F54632AA5F3734F68 |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|