File name: | 5.rar |
Full analysis: | https://app.any.run/tasks/d17fdfe5-49b7-452b-9fdf-830207514749 |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 20:30:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | EF39CD9AC9634144228165C3DAF13ADB |
SHA1: | 9666922100189AAA26D01E525543968494461858 |
SHA256: | FDCE051BDF808459CF48ACE2209871E3BA585A2CD6B35D49C7CF21C1BB25807A |
SSDEEP: | 393216:Wss26gANR+KqHqyWI4445VArOLGPq2KOuQW9vd7qN5/:Gx1sHNiVArPPy/HwN5/ |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2824 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5.rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
3724 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver "-an=C:\Users\admin\Desktop\Keygen.zip" -ad -- "C:\Users\admin\Desktop\webbuilder15x64.zip" C:\Users\admin\Desktop\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
408 | "C:\Users\admin\Desktop\Keygen\Keygen.exe" | C:\Users\admin\Desktop\Keygen\Keygen.exe | explorer.exe | |
User: admin Integrity Level: HIGH | ||||
1216 | "C:\Users\admin\Desktop\webbuilder15x64\setup64.exe" | C:\Users\admin\Desktop\webbuilder15x64\setup64.exe | explorer.exe | |
User: admin Company: Pablo Software Solutions Integrity Level: MEDIUM Description: WYSIWYG Web Builder 15 (64-bit) Setup Exit code: 1 Version: | ||||
3156 | "C:\Users\admin\AppData\Local\Temp\is-MRVPD.tmp\setup64.tmp" /SL5="$201C4,15813087,751104,C:\Users\admin\Desktop\webbuilder15x64\setup64.exe" | C:\Users\admin\AppData\Local\Temp\is-MRVPD.tmp\setup64.tmp | — | setup64.exe |
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 1 Version: 51.1052.0.0 | ||||
2284 | "C:\Users\admin\Desktop\webbuilder15x64\setup64.exe" /SPAWNWND=$501C8 /NOTIFYWND=$201C4 | C:\Users\admin\Desktop\webbuilder15x64\setup64.exe | setup64.tmp | |
User: admin Company: Pablo Software Solutions Integrity Level: HIGH Description: WYSIWYG Web Builder 15 (64-bit) Setup Exit code: 1 Version: | ||||
3368 | "C:\Users\admin\AppData\Local\Temp\is-NFG00.tmp\setup64.tmp" /SL5="$40166,15813087,751104,C:\Users\admin\Desktop\webbuilder15x64\setup64.exe" /SPAWNWND=$501C8 /NOTIFYWND=$201C4 | C:\Users\admin\AppData\Local\Temp\is-NFG00.tmp\setup64.tmp | — | setup64.exe |
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 1 Version: 51.1052.0.0 |
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\5.rar | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 | |||
(PID) Process: | (2824) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\AppData\Local\Temp |
PID | Process | Filename | Type | |
---|---|---|---|---|
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2824.6302\webbuilder15x64.zip | — | |
MD5:— | SHA256:— | |||
2824 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2824.6302\Keygen.zip | — | |
MD5:— | SHA256:— | |||
3724 | WinRAR.exe | C:\Users\admin\Desktop\webbuilder15x64\license.txt | text | |
MD5:B17A5C12B7E16625FDB443A9C7875B21 | SHA256:571DE068404F10065E7B31369EB2996C2A67CCC5B0791AE20343124169B71F18 | |||
3724 | WinRAR.exe | C:\Users\admin\Desktop\webbuilder15x64\whatsnew.txt | text | |
MD5:CE0BF526D14227AD619A2507BF0681D9 | SHA256:739863E1EF11249352CD8FE750C60FF195E019CF1CEBF99A5FAF463F753C36A1 | |||
3724 | WinRAR.exe | C:\Users\admin\Desktop\Keygen\Keygen.exe | executable | |
MD5:B025F62A6250E3D47615F0DDDC643A6B | SHA256:E24670F9E32C5DFB22496F1A2CAE9EDD8B34341A989BE50F2D3ADEB9FB287562 | |||
2284 | setup64.exe | C:\Users\admin\AppData\Local\Temp\is-NFG00.tmp\setup64.tmp | executable | |
MD5:95DE5986493351009D01ECD86CE53FAD | SHA256:75837A6D083C3FAC36CE84D97971C6165B8B628458708C8342C1374567C900C6 | |||
3724 | WinRAR.exe | C:\Users\admin\Desktop\webbuilder15x64\setup64.exe | executable | |
MD5:0BA5869AEDEE62F62210639340D0836D | SHA256:055E3B5CC3F056917F2D8D6B5331554F23F54351792A04624B7AF8D9CFCA3FB3 | |||
1216 | setup64.exe | C:\Users\admin\AppData\Local\Temp\is-MRVPD.tmp\setup64.tmp | executable | |
MD5:95DE5986493351009D01ECD86CE53FAD | SHA256:75837A6D083C3FAC36CE84D97971C6165B8B628458708C8342C1374567C900C6 |