File name:

SecuriteInfo.com.Win32.Trojan-gen.5467.15765

Full analysis: https://app.any.run/tasks/49e88ab7-a7f2-4949-a5be-b7788ccfcd65
Verdict: Malicious activity
Analysis date: December 05, 2022, 23:36:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
bitrat
rat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2AE6E69113D98E4F3BB815C21F626496

SHA1:

78920F0064D350E24812FDA6C5658AC6177B5CF5

SHA256:

0305B3A95AFF122C888A200DE747A565208EA19494C8257B0C972084141F42C4

SSDEEP:

24576:owfXt2qCbasU3cyK9pNhMhtrjxLF7ZQ/ronBb5:oEcO+9bh+1lLFaMnBb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BITRAT was detected

      • colorcpl.exe (PID: 3144)

    • Changes the autorun value in the registry

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Connects to the CnC server

      • colorcpl.exe (PID: 3144)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Adds/modifies Windows certificates

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Connects to SMTP port

      • colorcpl.exe (PID: 3144)

    • Checks Windows Trust Settings

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Connects to unusual port

      • colorcpl.exe (PID: 3144)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Reads settings of System Certificates

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

  • INFO

    • Reads the computer name

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Checks supported languages

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)

    • Checks proxy server information

      • SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe (PID: 3252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (53.2)
.exe | Win32 Executable Delphi generic (17.5)
.scr | Windows screen saver (16.1)
.exe | Win32 Executable (generic) (5.5)
.exe | Win16/32 Executable Delphi generic (2.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 1992-Jun-19 22:22:17
Detected languages:
  • English - United States
  • German - Germany
CompanyName: e-merge GmbH
FileDescription: http://www.winace.com
FileVersion: 2.69.0.0
InternalName:
LegalCopyright: 1997-2007 ACE Compression Software & e-merge GmbH
LegalTrademarks: 1997-2007 ACE Compression Software & e-merge GmbH
OriginalFilename:
ProductName: WinAce
ProductVersion: 02.69.00.00
Comments: Installation created by Sfx-Factory!,(c) 1997-2005 e-merge GmbH, http://www.emerge.de

DOS Header

e_magic: MZ
e_cblp: 80
e_cp: 2
e_crlc: 0
e_cparhdr: 4
e_minalloc: 15
e_maxalloc: 65535
e_ss: 0
e_sp: 184
e_csum: 0
e_ip: 0
e_cs: 0
e_ovno: 26
e_oemid: 0
e_oeminfo: 0
e_lfanew: 256

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 9
TimeDateStamp: 1992-Jun-19 22:22:17
PointerToSymbolTable: 0
NumberOfSymbols: 0
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
378268
378368
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.53109
.itext
385024
2048
2048
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.17862
.data
389120
7268
7680
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.76808
.bss
397312
14084
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata
413696
9856
10240
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.87882
.tls
425984
52
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata
430080
24
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.210826
.reloc
434176
26564
26624
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.70587
.rsrc
462848
607744
607744
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.53108

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.6633
308
UNKNOWN
English - United States
RT_CURSOR
2
2.80231
308
UNKNOWN
English - United States
RT_CURSOR
3
3.00046
308
UNKNOWN
English - United States
RT_CURSOR
4
2.56318
308
UNKNOWN
English - United States
RT_CURSOR
5
2.6949
308
UNKNOWN
English - United States
RT_CURSOR
6
2.62527
308
UNKNOWN
English - United States
RT_CURSOR
7
2.91604
308
UNKNOWN
English - United States
RT_CURSOR
52
5.29068
4264
UNKNOWN
UNKNOWN
RT_ICON
53
4.35947
21640
UNKNOWN
UNKNOWN
RT_ICON
54
4.16197
38056
UNKNOWN
UNKNOWN
RT_ICON

Imports

Kernel32
advapi32.dll
advapi32.dll (#2)
comctl32.dll
gdi32.dll
kernel32.dll
kernel32.dll (#2)
kernel32.dll (#3)
kernel32.dll (#4)
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.trojan-gen.5467.15765.exe #BITRAT colorcpl.exe

Process information

PID
CMD
Path
Indicators
Parent process
3252"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
Explorer.EXE
User:
admin
Company:
e-merge GmbH
Integrity Level:
MEDIUM
Description:
http://www.winace.com
Exit code:
0
Version:
2.69.0.0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.trojan-gen.5467.15765.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3144C:\Windows\System32\colorcpl.exeC:\Windows\System32\colorcpl.exe
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Color Control Panel
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\colorcpl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\colorui.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
4 756
Read events
4 713
Write events
41
Delete events
2

Modification events

(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3252) SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
1
Suspicious files
6
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PNPSHFWX.txttext
MD5:3415A3FC52A170C720939A243A724545
SHA256:4EAD4091258848F02B6F7334FEE310AC3876E411C73595FF781777A7B4975FF4
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:342066D17331A67027A5D9E0C9964F9A
SHA256:1DBCCED7FE1B9FF1AABBCBFCA6D3D99068453218A7261F8AF6572583B1DC9FC0
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53binary
MD5:0E35D5FF8655DC6A30017912C84F4683
SHA256:26D6A06C3910B0C53D31C4FBBEA623739909807867DA78B989A6988C2D74B4D4
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\Public\Libraries\Cjyuaeblbinary
MD5:33DAF581F37766E63D01955CD5C946D2
SHA256:A07A521A0535F989921CB1AEE82D8FFCDF4402C4AFD3F6E2230DB315FB12CCF2
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\Public\Libraries\Cjyuaebl.exeexecutable
MD5:2AE6E69113D98E4F3BB815C21F626496
SHA256:0305B3A95AFF122C888A200DE747A565208EA19494C8257B0C972084141F42C4
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Cjyuaeblxvk[1]binary
MD5:33DAF581F37766E63D01955CD5C946D2
SHA256:A07A521A0535F989921CB1AEE82D8FFCDF4402C4AFD3F6E2230DB315FB12CCF2
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C22C07AE54594FD45955FCD073E987B3
SHA256:435CDE128849DF862FDBF215FC2B51E0999DCCE7ADC7B0022BE203CA1E2F39F9
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53der
MD5:8572F60C3D290AB98BC369AE8EEBFF9C
SHA256:B4BE06A39491F6DF0412436B81B6CF29A608866DBCC88435A540201A250F0549
3252SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exeC:\Users\Public\Libraries\lbeauyjC.urltext
MD5:E1EB91510EA5CED30CED72A9A011AD66
SHA256:AC58E44011D4FD00EFCB03BBF7CF9980DBD5D889C1FC9157DF875E2C3594F65D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
5
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
GET
200
23.32.238.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e354cf1912417ef4
US
compressed
4.70 Kb
whitelisted
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
13.107.42.12:443
2630fq.ch.files.1drv.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
3144
colorcpl.exe
20.84.45.190:5877
winery.nsupdate.info
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
23.32.238.178:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
suspicious
3252
SecuriteInfo.com.Win32.Trojan-gen.5467.15765.exe
13.107.43.13:443
onedrive.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious

DNS requests

Domain
IP
Reputation
onedrive.live.com
  • 13.107.43.13
shared
ctldl.windowsupdate.com
  • 23.32.238.178
  • 23.32.238.201
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
2630fq.ch.files.1drv.com
  • 13.107.42.12
suspicious
winery.nsupdate.info
  • 20.84.45.190
malicious

Threats

PID
Process
Class
Message
3144
colorcpl.exe
A Network Trojan was detected
ET TROJAN Observed Malicious SSL Cert (BitRAT CnC)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.Trojan-gen.5467.15765