File name: | General.one.zip |
Full analysis: | https://app.any.run/tasks/94306baf-5a31-456f-ae9f-b59c0893b0e7 |
Verdict: | Malicious activity |
Analysis date: | November 14, 2018, 16:48:03 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 47E0ACFA1F42F41BB707966E09259151 |
SHA1: | CDF34927E9338A6A7628CA69E2E2B35589C9C825 |
SHA256: | E4A579D6F05AFB0BE47012CF3410DAFBA6159125F656612471D32C337D0826C4 |
SSDEEP: | 24576:HN3SOhMmIQq4i5Z268s4noLsAw1NQ4k7Fqa1kdedIFFNe+TqSbloiiRXW2om14ql:VSOD1GKXoLT37eemFzefSgRfob9wiSf |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | General.one |
---|---|
ZipUncompressedSize: | 1911920 |
ZipCompressedSize: | 1700170 |
ZipCRC: | 0xe94b8e52 |
ZipModifyDate: | 2018:11:14 17:47:17 |
ZipCompression: | Deflated |
ZipBitFlag: | 0x0001 |
ZipRequiredVersion: | 788 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3728 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\General.one.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2664 | "C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE" "C:\Users\admin\AppData\Local\Temp\Rar$DIb3728.11569\General.one" | C:\Program Files\Microsoft Office\Office14\ONENOTE.EXE | WinRAR.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneNote Version: 14.0.6022.1000 | ||||
3664 | /tsr | C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE | — | ONENOTE.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft OneNote Quick Launcher Version: 14.0.6015.1000 |
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\General.one.zip | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
Operation: | write | Name: | ShowPassword |
Value: 0 | |||
(PID) Process: | (3728) WinRAR.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
Operation: | write | Name: | OneNoteFiles |
Value: 1299054598 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\CVRE45A.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\8a7b3433-d918-4375-85d0-3a46a8f87015.png | image | |
MD5:527F97F6423EB0F67964A4681E7C4A36 | SHA256:2FCCC3745E495312C6868032D0F1C96C4C420C83C2712FF485BEC73673298B66 | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{C59F1301-F2F4-4273-83CC-A08BBE2C2D59} | image | |
MD5:527F97F6423EB0F67964A4681E7C4A36 | SHA256:2FCCC3745E495312C6868032D0F1C96C4C420C83C2712FF485BEC73673298B66 | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk | lnk | |
MD5:F6AAFAFD458A059612E8B97822364675 | SHA256:4C75A44129170849AD8817986860305F4E202CD7D4045E5CF5FCD499CE991023 | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\327f48ac-d990-452a-8be3-28d0b6d8324d.png | image | |
MD5:A0CAF46A55C074FBFDE0499E361B04B9 | SHA256:729EF4340C4ECAFA86E6A3281BFF6811077BAD72C5077982351093BD2B57C96D | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{234665AB-E1A3-4D44-AADB-AADDC8232C49} | image | |
MD5:2A788EF1DFFBD2BB2A6E3B3088773C84 | SHA256:C2036B8BAD9E63FBEE75A68970B210DECD32C7554F13F36B02371B698FBE085E | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\2c2322a5-e5cc-4548-bdcf-0282fc0ea4b8.png | image | |
MD5:2A788EF1DFFBD2BB2A6E3B3088773C84 | SHA256:C2036B8BAD9E63FBEE75A68970B210DECD32C7554F13F36B02371B698FBE085E | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{1F66221E-5AD3-4A97-8262-969680AE73C6} | oxps | |
MD5:C2B48978A1A2606132E8658F568FF300 | SHA256:EC6491562E955AEBA530A270321F6E60D6A4184183A1DEFE245C6ABBC6AE3A86 | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Microsoft\OneNote\14.0\OneNoteOfflineCache_Files\201b651c-b8b9-4aa7-8cd1-01eab8c2f4a2.xps | oxps | |
MD5:C2B48978A1A2606132E8658F568FF300 | SHA256:EC6491562E955AEBA530A270321F6E60D6A4184183A1DEFE245C6ABBC6AE3A86 | |||
2664 | ONENOTE.EXE | C:\Users\admin\AppData\Local\Temp\{E4C62DB5-1E3B-4B27-96B1-BFF0C97FD3C2} | image | |
MD5:A0CAF46A55C074FBFDE0499E361B04B9 | SHA256:729EF4340C4ECAFA86E6A3281BFF6811077BAD72C5077982351093BD2B57C96D |