File name: | $R2KFKFE.zip.7z |
Full analysis: | https://app.any.run/tasks/590d47d3-e9cf-41b1-9572-fcf7d3b1ae62 |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 16:13:01 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-7z-compressed |
File info: | 7-zip archive data, version 0.4 |
MD5: | 80114163DFD386AC3CA5F26915FC7C85 |
SHA1: | CF58D91B6FC990D5F771DBB2ECE24B34EC8B7A92 |
SHA256: | E2D6D34E8F639EF470CF326673B70626FED6AF4EBF1FD0A226A024CFFBA11773 |
SSDEEP: | 1536:gpZsjkG8QIvYZNHHv4bd1djVWUVrXWDeOMaji7LUHfKaGrLIR1MS79JfHbeD:WQkG8mnvijV/VrXieOLzHSjIRd79J/bI |
.7z | | | 7-Zip compressed archive (v0.4) (57.1) |
---|---|---|
.7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
924 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\$R2KFKFE.zip.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
2380 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\$R2KFKFE.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
2608 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\free_trade_agreement_australia_uk_lawyers 81532.js" | C:\Windows\System32\WScript.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
1684 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\free_trade_agreement_australia_uk_lawyers 81532.js" | C:\Windows\System32\WScript.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
1380 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\free_trade_agreement_australia_uk_lawyers 81532.js" | C:\Program Files\Notepad++\notepad++.exe | Explorer.EXE | ||||||||||||
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Version: 7.91 Modules
|
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\$R2KFKFE.zip.7z | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (924) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
924 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb924.34556\$R2KFKFE.zip | compressed | |
MD5:EEF11C8538924CAA34D18481FD33D62B | SHA256:A055730E8B8FE5E6C0A134BFE8F5522D4630B216F696B77FCBA7FBD209EF9878 | |||
2380 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2380.35637\free_trade_agreement_australia_uk_lawyers 81532.js | text | |
MD5:F0831DF06B606827CE6BEFA0EE0FAC2B | SHA256:430571978386771D2A11A7D012B4808990F4F64CF9EF01557182CCBD818C525E | |||
2608 | WScript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:B9F21D8DB36E88831E5352BB82C438B3 | SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E | |||
2608 | WScript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:0DC39F6E3346B0935884A58E307A3615 | SHA256:37F7E6419E02E6D3D4B2618EA433B7C73BB42CB35FE81AECA4D04F75A03CC794 | |||
2608 | WScript.exe | C:\Users\admin\AppData\Local\Temp\Tar7023.tmp | cat | |
MD5:E721613517543768F0DE47A6EEEE3475 | SHA256:3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E | |||
2608 | WScript.exe | C:\Users\admin\AppData\Local\Temp\Cab7022.tmp | compressed | |
MD5:B9F21D8DB36E88831E5352BB82C438B3 | SHA256:998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2608 | WScript.exe | GET | 200 | 23.216.77.69:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?412beb2394654c8f | US | compressed | 60.0 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2608 | WScript.exe | 23.216.77.69:80 | ctldl.windowsupdate.com | NTT DOCOMO, INC. | US | suspicious |
2608 | WScript.exe | 195.113.57.133:443 | www.labbunnies.eu | CESNET z.s.p.o. | CZ | unknown |
2608 | WScript.exe | 93.114.184.91:443 | www.lenovob2bportal.com | NetConnex Broadband Ltd. | GB | unknown |
Domain | IP | Reputation |
---|---|---|
www.labbunnies.eu |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
www.lenovob2bportal.com |
| unknown |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|