URL: | http://www.mediafire.com/file/2xgerydk6utpfx4/FAC_PR0.7z/file |
Full analysis: | https://app.any.run/tasks/0c984211-0616-4f29-8ea6-0623c828a0b3 |
Verdict: | Malicious activity |
Analysis date: | July 12, 2020, 17:29:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MD5: | DF24FC9D1121D3AC4F420871006569B0 |
SHA1: | 7E11980C8B1AA5D65A040F16B19E8284A4CEC9CE |
SHA256: | E461C0637729985BA42EEC1E2DD2DFC8D72FBA729D3340B427297D68AA3DB6E8 |
SSDEEP: | 3:N1KJS4w3eGUoXdDydnRSix:Cc4w3eGzlYRrx |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
840 | "C:\Program Files\Internet Explorer\iexplore.exe" http://www.mediafire.com/file/2xgerydk6utpfx4/FAC_PR0.7z/file | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
288 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:840 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) | ||||
2164 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FAC_PR0.7z" | C:\Program Files\WinRAR\WinRAR.exe | iexplore.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
2188 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2164.34669\FAC_PR0.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2164.34669\FAC_PR0.exe | WinRAR.exe | |
User: admin Company: J/n78xF)r+9R2gM Integrity Level: MEDIUM Description: Yy6%i$L89Np&_q7HX^ Exit code: 0 Version: 6.9.12.14 | ||||
2672 | "C:\Users\admin\Desktop\FAC_PR0.exe" | C:\Users\admin\Desktop\FAC_PR0.exe | — | explorer.exe |
User: admin Company: J/n78xF)r+9R2gM Integrity Level: MEDIUM Description: Yy6%i$L89Np&_q7HX^ Exit code: 0 Version: 6.9.12.14 | ||||
2764 | "C:\Users\admin\AppData\Local\Temp\InstallUtil.exe" | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | FAC_PR0.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: .NET Framework installation utility Exit code: 4294967295 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3224 | "C:\Users\admin\Desktop\FAC_PR0.exe" | C:\Users\admin\Desktop\FAC_PR0.exe | explorer.exe | |
User: admin Company: J/n78xF)r+9R2gM Integrity Level: HIGH Description: Yy6%i$L89Np&_q7HX^ Exit code: 0 Version: 6.9.12.14 | ||||
1912 | "C:\Users\admin\AppData\Local\Temp\InstallUtil.exe" | C:\Users\admin\AppData\Local\Temp\InstallUtil.exe | FAC_PR0.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: .NET Framework installation utility Version: 4.7.3062.0 built by: NET472REL1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
288 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1OKV1YFK.txt | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF176EF7C55CD35306.TMP | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FAC_PR0.7z.4zah1oc.partial:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
2164 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2164.36102\FAC_PR0.exe | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFCD9A52480C8A8B15.TMP | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{4D06C815-C465-11EA-9F9D-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab45F2.tmp | — | |
MD5:— | SHA256:— | |||
840 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar45F3.tmp | — | |
MD5:— | SHA256:— | |||
288 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\FAC_PR0[1].7z | compressed | |
MD5:619F1248D2632F50427352870766BDF5 | SHA256:4F8F3617D25F5383DD377A6FD6C4F2BE338C8EA825B19F827D118A05C130B973 | |||
288 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FAC_PR0.7z.4zah1oc.partial | compressed | |
MD5:619F1248D2632F50427352870766BDF5 | SHA256:4F8F3617D25F5383DD377A6FD6C4F2BE338C8EA825B19F827D118A05C130B973 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
288 | iexplore.exe | GET | 302 | 104.16.202.237:80 | http://www.mediafire.com/file/2xgerydk6utpfx4/FAC_PR0.7z/file | US | — | — | shared |
840 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
288 | iexplore.exe | GET | 200 | 199.91.152.162:80 | http://download1662.mediafire.com/eg4b373rwplg/2xgerydk6utpfx4/FAC_PR0.7z | US | compressed | 267 Kb | malicious |
840 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
840 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
288 | iexplore.exe | 199.91.152.162:80 | download1662.mediafire.com | MediaFire, LLC | US | malicious |
840 | iexplore.exe | 152.199.19.161:443 | iecvlist.microsoft.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
288 | iexplore.exe | 104.16.202.237:80 | www.mediafire.com | Cloudflare Inc | US | unknown |
840 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1912 | InstallUtil.exe | 77.88.21.158:587 | smtp.yandex.ru | YANDEX LLC | RU | whitelisted |
2764 | InstallUtil.exe | 77.88.21.158:587 | smtp.yandex.ru | YANDEX LLC | RU | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.mediafire.com |
| shared |
download1662.mediafire.com |
| malicious |
iecvlist.microsoft.com |
| whitelisted |
r20swj13mr.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
smtp.yandex.ru |
| shared |
PID | Process | Class | Message |
---|---|---|---|
288 | iexplore.exe | Generic Protocol Command Decode | SURICATA HTTP unable to match response to request |
2764 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |
1912 | InstallUtil.exe | Generic Protocol Command Decode | SURICATA Applayer Detect protocol only one direction |