Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll |
Jump to behavior |
Source: classification engine |
Classification label: clean2.winZIP@4/1@0/0 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Mutant created: NULL |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File created: C:\Users\user\AppData\Local\Temp\unarchiver.log |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: unknown |
Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\2293139_Files_20241007105542_2293139_Files_tutorial8_v4.0 (1).zip" |
|
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ff5owwsh.bgr" "C:\Users\user\Desktop\2293139_Files_20241007105542_2293139_Files_tutorial8_v4.0 (1).zip" |
|
Source: C:\Windows\SysWOW64\7za.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ff5owwsh.bgr" "C:\Users\user\Desktop\2293139_Files_20241007105542_2293139_Files_tutorial8_v4.0 (1).zip" |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\7za.exe |
Section loaded: 7z.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll |
Jump to behavior |
Source: 2293139_Files_20241007105542_2293139_Files_tutorial8_v4.0 (1).zip |
Static file information: File size 39196241 > 1048576 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: 1630000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: 3510000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: 5510000 memory commit | memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Window / User API: threadDelayed 549 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Window / User API: threadDelayed 9420 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7268 |
Thread sleep count: 549 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7268 |
Thread sleep time: -274500s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7268 |
Thread sleep count: 9420 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 7268 |
Thread sleep time: -4710000s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 6_2_0151B1D6 GetSystemInfo, |
6_2_0151B1D6 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: page read and write | page guard |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\ff5owwsh.bgr" "C:\Users\user\Desktop\2293139_Files_20241007105542_2293139_Files_tutorial8_v4.0 (1).zip" |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Jump to behavior |