Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll |
Jump to behavior |
Source: classification engine |
Classification label: clean2.winZIP@4/1@0/0 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Mutant created: NULL |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2744:120:WilError_03 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File created: C:\Users\user\AppData\Local\Temp\unarchiver.log |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
Jump to behavior |
Source: unknown |
Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Desktop\Quarantined Messages (12).zip" |
|
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\mlkax1j3.a2v" "C:\Users\user\Desktop\Quarantined Messages (12).zip" |
|
Source: C:\Windows\SysWOW64\7za.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\mlkax1j3.a2v" "C:\Users\user\Desktop\Quarantined Messages (12).zip" |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: mscoree.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: apphelp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: profapi.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: cryptsp.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: rsaenh.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Section loaded: cryptbase.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\7za.exe |
Section loaded: 7z.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_00C225C1 push eax; iretd |
0_2_00C225C2 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_00C22D7D push edx; iretd |
0_2_00C22D7E |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_010D0C9F push ds; ret |
0_2_010D0CA2 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_010D0C99 push ds; ret |
0_2_010D0C9A |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_010D0C9B push ds; ret |
0_2_010D0C9E |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: E80000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: 2D40000 memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: 1020000 memory commit | memory reserve | memory write watch |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Window / User API: threadDelayed 553 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Window / User API: threadDelayed 9413 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3260 |
Thread sleep count: 553 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3260 |
Thread sleep time: -276500s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3260 |
Thread sleep count: 9413 > 30 |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 3260 |
Thread sleep time: -4706500s >= -30000s |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Code function: 0_2_00C2B1D6 GetSystemInfo, |
0_2_00C2B1D6 |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Memory allocated: page read and write | page guard |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\mlkax1j3.a2v" "C:\Users\user\Desktop\Quarantined Messages (12).zip" |
Jump to behavior |
Source: C:\Windows\SysWOW64\unarchiver.exe |
Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid |
Jump to behavior |