File name: | SnowbotTouchV1.2.2-cracked.zip |
Full analysis: | https://app.any.run/tasks/63eb191e-39c6-4520-bdfc-488593554866 |
Verdict: | Malicious activity |
Analysis date: | December 14, 2018, 09:41:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 40C475732AF2239D2D37F7B14CFA67B3 |
SHA1: | 54420133C6D01445D8C114459C339DE8C65EBBC0 |
SHA256: | F544A6ECF45BA3BA7FBF48F38C0C3610ACF70D3854B532A417A1E8855BA21DDD |
SSDEEP: | 393216:LvfNMlpgv89WAjWIV2PZwND2OlLiTF9r+5cu:LnepghwWIV2PZm2OkB+5cu |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | SnowbotTouchV1.2.2-cracked/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2018:12:14 02:37:00 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3336 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SnowbotTouchV1.2.2-cracked.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1732 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
2240 | "C:\Users\admin\Desktop\SnowbotTouchV1.2.2-cracked\SwiftBotTouch-cracked.exe" | C:\Users\admin\Desktop\SnowbotTouchV1.2.2-cracked\SwiftBotTouch-cracked.exe | explorer.exe | |
User: admin Integrity Level: HIGH Description: SwiftBot Exit code: 0 Version: 1.0.0.0 |
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\SnowbotTouchV1.2.2-cracked.zip | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3336) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2240) SwiftBotTouch-cracked.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2240) SwiftBotTouch-cracked.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\vcredist_x86.exe | — | |
MD5:— | SHA256:— | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\websocket-sharp.dll | — | |
MD5:— | SHA256:— | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\KeraLua.dll | executable | |
MD5:8DC33460CE3561739AB6299F7E1D3035 | SHA256:06834D329999D4D2DE2F90140FFD6F99E6FAA1E1C766D820B6E8AD5CDCF1D39F | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\rebex.net.proxysocket.dll | executable | |
MD5:B8EAF61DB1E51536282BF756451C5B5A | SHA256:719889796109C5DB75415E35B70841050F1965F921C87BC73142D23804670ADA | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\SwiftBotTouch-cracked.exe | executable | |
MD5:9E78DB29C11CF5AD3E7525816EC053A7 | SHA256:B99267A17F3DED84E3C3A91F338255223D98F21947125A8D9E78D8D03E7F6A76 | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\No.Ankama.dll | executable | |
MD5:15132634FE8A8A9051307BE3B3A8E8AF | SHA256:723C5FA46EAAF48E01C6D69EB7AF0B1CA4F067C59DECC96A05797E46A193844E | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\lua52.dll | executable | |
MD5:A5529D6A2C26FC16F35DB0DD04E27B4B | SHA256:D39FD2A953A8E483E42053D491B5023B6D15427A31FBD2F91A61DE3FF4B3355F | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\NLua.dll | executable | |
MD5:647392BEBD1012D2BB582E057D5F698C | SHA256:2CA15E0BDDE258E8237987C419B27C2E99001C1EABA65C94C1E8F21ECED94AB7 | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\Newtonsoft.Json.dll | executable | |
MD5:C53737821B861D454D5248034C3C097C | SHA256:575E30F98E4EA42C9E516EDC8BBB29AD8B50B173A3E6B36B5BA39E133CCE9406 | |||
3336 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3336.7380\SnowbotTouchV1.2.2-cracked\RestSharp.dll | executable | |
MD5:545F418225B4BF04D7DBFE1B7FEF55D9 | SHA256:93BC87FE592ED8EC971018CB2D78F9AEF0BC049AB5A1DAA947D07C6F292B101E |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2240 | SwiftBotTouch-cracked.exe | 93.115.96.98:1111 | — | Techcrea Solutions SARL | FR | unknown |