File name: | pf.zip |
Full analysis: | https://app.any.run/tasks/8536e90d-a922-4a96-b924-8e833ae9af50 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 20:06:33 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 90B901191FB837ECD03B591D2CEEFD9A |
SHA1: | BF200150DD3F4F61898B44F53F6756C804821094 |
SHA256: | F4C1D831719DEFF3F583396038B9181B316E509AC410132BFA4EE2334C3121F6 |
SSDEEP: | 49152:TmPNJDnvx4+Zf95vAH3W0l79GFmZS0bn3VLIPLS0Le:6Fr4+Zfh0t9RZS0bn3BSB6 |
.zip | | | ZIP compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1772 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\pf.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
3752 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\pf\6.msi" | C:\Windows\System32\msiexec.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
4068 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2980 | C:\Windows\system32\MsiExec.exe -Embedding B2A5C7B6599FA074A7202733C0DCD029 | C:\Windows\system32\MsiExec.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1232 | C:\Windows\system32\MsiExec.exe -Embedding DC85B2E1F3AF71BB631842C1153117BA E Global\MSI0000 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3424 | "C:\Windows\System32\netsh.exe" interface ipv6 install | C:\Windows\System32\netsh.exe | — | MsiExec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2084 | "C:\Windows\System32\netsh.exe" ipsec static add policy name=qianye | C:\Windows\System32\netsh.exe | — | MsiExec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2296 | "C:\Windows\System32\netsh.exe" ipsec static add filterlist name=Filter1 | C:\Windows\System32\netsh.exe | — | MsiExec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3300 | "C:\Windows\System32\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP | C:\Windows\System32\netsh.exe | — | MsiExec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3944 | "C:\Windows\System32\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP | C:\Windows\System32\netsh.exe | — | MsiExec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
4068 | msiexec.exe | C:\Windows\.ini | binary | |
MD5:5AEB240A710E216CAEDC7076854B4B73 | SHA256:00E356C97DC28B1A9DBE56EB3F9A0B8268C378F36621E244FA0D8EE80B418BBD | |||
4068 | msiexec.exe | C:\Windows\.xml | executable | |
MD5:FA18BFA030D5C7BD2BACAA2A0C221A8F | SHA256:72E272786C588E05DE555BC2736B0AEA445D6F5C1B350691885E91B5C3EAB2D8 | |||
1772 | WinRAR.exe | C:\Users\admin\Desktop\pf\M0021.cab | compressed | |
MD5:D890DFFC7A00BCEB5F711C9E0C845F71 | SHA256:C06E1FBBB0C8B8E3B39B1BC0BC8F5E4F363323935BF80EC1BD485C4D62A174DD | |||
4068 | msiexec.exe | C:\Windows\Installer\1073681.msi | executable | |
MD5:AFA28919D47521ADBA7461158FC6B492 | SHA256:A59CF93E176E1CD793F09AEDDE5C4333867F1D950A496673F7E3E71661F14862 | |||
4068 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF8C6F74876A5782E9.TMP | gmc | |
MD5:CE77455A10D3BB17C9BD876C771F6B5F | SHA256:13452BD247032ED52C2D4EF5787503D97A3D1494665008DE3BC5B69F27FA2EA9 | |||
4068 | msiexec.exe | C:\Windows\Installer\SourceHash{80395032-1630-4C4B-A997-0A7CCB72C75B} | binary | |
MD5:0A44952F454C8F5EF58220AB7A11CF2D | SHA256:D1CE50455BB79B9EC99F944B94AF421EDE3D5159D65BB7483273E06C2769DDF3 | |||
3168 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-638E4F85-C60.pma | — | |
MD5:— | SHA256:— | |||
4068 | msiexec.exe | C:\Windows\Installer\1073683.ipi | binary | |
MD5:2FED574D2D9A704C0756D9F80D926952 | SHA256:617E1E1BF5EEC6F1F2E9D6FA8F8B1BC912FEC039CB15DD2685BC4C2E984B4B3E | |||
1772 | WinRAR.exe | C:\Users\admin\Desktop\pf\6.msi | executable | |
MD5:AFA28919D47521ADBA7461158FC6B492 | SHA256:A59CF93E176E1CD793F09AEDDE5C4333867F1D950A496673F7E3E71661F14862 | |||
4068 | msiexec.exe | C:\Config.Msi\1073684.rbs | binary | |
MD5:7431F4DA62AA670B84561173CC1E3A38 | SHA256:3EB125FEEA619A9FC03CE118DBD720D8D0E3573F08737ABF0AFEA9E6BB51123E |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 23.203.90.83:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133147445655780000 | US | — | — | whitelisted |
— | — | HEAD | 200 | 23.203.90.83:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133147446004680000 | US | — | — | whitelisted |
— | — | HEAD | 200 | 104.109.59.136:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133147445309530000 | NL | — | — | whitelisted |
3240 | sipnotify.exe | HEAD | 200 | 23.205.225.13:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133147444704350000 | NL | — | — | whitelisted |
3260 | chrome.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | crx | 242 Kb | whitelisted |
3240 | sipnotify.exe | GET | 200 | 23.205.225.13:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133147444704350000 | NL | compressed | 78.4 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3260 | chrome.exe | 172.217.18.3:443 | fonts.gstatic.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.185.68:443 | www.google.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.186.46:443 | clients2.google.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.186.141:443 | accounts.google.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.184.227:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 216.58.212.161:443 | clients2.googleusercontent.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.186.131:443 | www.gstatic.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.185.202:443 | fonts.googleapis.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 172.217.16.206:443 | apis.google.com | GOOGLE | US | whitelisted |
3260 | chrome.exe | 142.250.185.195:443 | update.googleapis.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
clientservices.googleapis.com |
| whitelisted |
clients2.google.com |
| whitelisted |
www.google.com |
| whitelisted |
accounts.google.com |
| shared |
clients2.googleusercontent.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
Process | Message |
---|---|
MsiExec.exe | [AVX_CRT_Fix][C:\Windows\Installer\MSI376C.tmp] CPU: __isa_available = 5
|
MsiExec.exe | [AVX_CRT_Fix][C:\Windows\Installer\MSI37CB.tmp] CPU: __isa_available = 5
|
MsiExec.exe | [AVX_CRT_Fix][C:\Windows\Installer\MSI37DB.tmp] CPU: __isa_available = 5
|
MsiExec.exe | [AVX_CRT_Fix][C:\Windows\Installer\MSI37FB.tmp] CPU: __isa_available = 5
|