File name: | vencida_J652578.zip |
Full analysis: | https://app.any.run/tasks/ca273dd3-0c55-40d3-b57a-94cc7b2830d1 |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 16:48:20 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | D7930677973A81830433F17BD56BA842 |
SHA1: | E1A6DCBB292CD7A64071BACF5A8C00A07981EA25 |
SHA256: | F5061906FFE0725067ADA699207270F653CEEB28BB55068CFAFA9CAFCFDF6001 |
SSDEEP: | 24576:cuCuJmFxlGtvJQ2sNLb9rVKMURxtffdLYmHNRUqzfEm8RmzduiZ3PozJEQ1O1n7D:8uJeQi24b90lnBFtS08RvltEsW7jU2 |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | vencida_zwrkppzaxqa.msi |
---|---|
ZipUncompressedSize: | 4382208 |
ZipCompressedSize: | 1749424 |
ZipCRC: | 0xcf26370f |
ZipModifyDate: | 2021:08:24 19:57:14 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3912 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\vencida_J652578.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
1440 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa3912.6382\vencida_zwrkppzaxqa.msi" | C:\Windows\System32\msiexec.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3956 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows� installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2228 | C:\Windows\system32\MsiExec.exe -Embedding 0ECF5CB1F359711551DB633C4229FC91 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3720 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXa3912.7228\vencida_zwrkppzaxqa.msi" | C:\Windows\System32\msiexec.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3408 | C:\Windows\system32\MsiExec.exe -Embedding D9DCC003DFA71B12513676F3A4A3C05F | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows� installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\vencida_J652578.zip | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3912) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3912 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3912.6382\vencida_zwrkppzaxqa.msi | — | |
MD5:— | SHA256:— | |||
3956 | msiexec.exe | C:\Windows\Installer\19450e.msi | — | |
MD5:— | SHA256:— | |||
3912 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa3912.7228\vencida_zwrkppzaxqa.msi | — | |
MD5:— | SHA256:— | |||
3956 | msiexec.exe | C:\Windows\Installer\194512.msi | — | |
MD5:— | SHA256:— | |||
3956 | msiexec.exe | C:\Config.Msi\194511.rbs | binary | |
MD5:5DD8D70CAB9AFFEE6B61534D330DE982 | SHA256:FD2C749E246A44B18DE5D4C8681BC3188936F894845B6BF956A98EC051CCF306 | |||
3956 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DF4C24555C42BD8883.TMP | gmc | |
MD5:0B8D5A23659F91A4F775CE69B01CDB83 | SHA256:CA88B650B2637F871F876729F4A3632BAF3DC64169F0D53C689CDD1A720E84D7 | |||
3956 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DFE19BA4E24D103457.TMP | gmc | |
MD5:5522E742B08EE2C90C5CCF5E292F2E83 | SHA256:B5D8ECC3B855EF17422BB8C385FDAFC9FC32FE08A22EDDB3312EF62300A80C35 | |||
3956 | msiexec.exe | C:\Windows\Installer\SourceHash{B9336F0D-359B-45BE-BF2A-8661F790585D} | binary | |
MD5:D999DC0F57D855AC4ACCCFC220509F09 | SHA256:3E8E977BEDEC86FF921B9B06EE5D627FC1BEE1B38A279B03F453CEA7921A710D | |||
3956 | msiexec.exe | C:\Users\admin\AppData\Local\Temp\~DFA323358055D33BA8.TMP | gmc | |
MD5:5522E742B08EE2C90C5CCF5E292F2E83 | SHA256:B5D8ECC3B855EF17422BB8C385FDAFC9FC32FE08A22EDDB3312EF62300A80C35 | |||
3956 | msiexec.exe | C:\Config.Msi\194515.rbs | binary | |
MD5:4A726516EC5B8BA7DEFD6AFE9DB7D7D1 | SHA256:509C0FE012F82E687BAD4515B47ECCC701AD3CE88F4EC69D9FB89A6D42EA43C2 |