File name: | DE_OfficeStandard2021_VL_64bit.exe |
Full analysis: | https://app.any.run/tasks/b0528fdf-1bd6-48ee-ae95-9cb12e0c7923 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 21:09:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 9796AF6D8AD32F8ED4B2FF6C6BEFDF7D |
SHA1: | 33A72F11B2D2CE03BB2EF7842EA0615BC256467C |
SHA256: | 06D3719C9529D75B1CC7BDF6B6248697E479B2F1363967F5A9294A3C8CCEDCF1 |
SSDEEP: | 49152:b8i8DAyaARmp13kzsC91iMDtM+H75f5fLKrxtdp5OS6u3Gx+RwOoiA3nzpw7R4nC:b8iya13/HMZM275RTKVtYRF+RrFA3nzq |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2016-Oct-04 15:12:31 |
Detected languages: |
|
CompanyName: | Igor Pavlov |
FileDescription: | 7z Setup SFX |
FileVersion: | 16.04 |
InternalName: | 7zS.sfx |
LegalCopyright: | Copyright (c) 1999-2016 Igor Pavlov |
OriginalFilename: | 7zS.sfx.exe |
ProductName: | 7-Zip |
ProductVersion: | 16.04 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 272 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2016-Oct-04 15:12:31 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 93125 | 93184 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.63827 |
.rdata | 98304 | 14356 | 14848 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.23725 |
.data | 114688 | 9264 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.87468 |
.sxdata | 126976 | 4 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 131072 | 2736 | 3072 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.331 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.75404 | 744 | UNKNOWN | English - United States | RT_ICON |
2 | 3.18403 | 296 | UNKNOWN | English - United States | RT_ICON |
97 | 3.04857 | 184 | UNKNOWN | English - United States | RT_DIALOG |
188 | 2.17822 | 84 | UNKNOWN | English - United States | RT_STRING |
207 | 1.43775 | 52 | UNKNOWN | English - United States | RT_STRING |
1 (#2) | 2.38262 | 96 | UNKNOWN | English - United States | RT_STRING |
1 (#3) | 2.37086 | 34 | UNKNOWN | English - United States | RT_GROUP_ICON |
1 (#4) | 3.45504 | 700 | UNKNOWN | English - United States | RT_VERSION |
KERNEL32.dll |
MSVCRT.dll |
OLEAUT32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
856 | "C:\Users\admin\AppData\Local\Temp\DE_OfficeStandard2021_VL_64bit.exe" | C:\Users\admin\AppData\Local\Temp\DE_OfficeStandard2021_VL_64bit.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7z Setup SFX Exit code: 3221226540 Version: 16.04 Modules
| |||||||||||||||
3236 | "C:\Users\admin\AppData\Local\Temp\DE_OfficeStandard2021_VL_64bit.exe" | C:\Users\admin\AppData\Local\Temp\DE_OfficeStandard2021_VL_64bit.exe | Explorer.EXE | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Version: 16.04 Modules
| |||||||||||||||
3480 | "C:\Users\admin\AppData\Local\Temp\7zS4ACE2327\setup.exe" /configure Configuration.xml | C:\Users\admin\AppData\Local\Temp\7zS4ACE2327\setup.exe | DE_OfficeStandard2021_VL_64bit.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Office Version: 16.0.14326.20152 Modules
| |||||||||||||||
788 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} " | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
3212 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} " | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
3480 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9E | der | |
MD5:27764D909B876F6BCE274D5EC706DD67 | SHA256:A9C00AFC9DAF5BF0BA4547E433F3A0C8E9E2C73AAC0E08DDC22E36A24966AC95 | |||
3480 | setup.exe | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\setup.exe_Rules.xml | xml | |
MD5:CC1E2177754466DF40F5F3A0124B8AE8 | SHA256:44C557BECEEEA1A673DD9627D7829E3CC90A0D93092999EAE6A6D8EC0C2B193B | |||
3236 | DE_OfficeStandard2021_VL_64bit.exe | C:\Users\admin\AppData\Local\Temp\7zS4ACE2327\Configuration.xml | text | |
MD5:91C1669AE77EB3BF7F3C8CBAD42A4CF4 | SHA256:F611A03394F6B70318A7D7E36E02E39827228C8BA32D0247E1FFE053A105AAC2 | |||
3480 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FE | der | |
MD5:9F4A04813B4240A488B223BF21F35999 | SHA256:4C80294EADE4721164E57DDFA9684FA0554C65741C16E77039A3E95CF608ED54 | |||
788 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch | text | |
MD5:03CA949E980AD3A9B98D66D053ACAE2C | SHA256:BD3B1323C2E19053EED647AC73AED55053789FB505EDD068514810B5149BAA12 | |||
3480 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850 | binary | |
MD5:83A9B2A52BFC42C9F5A17EBD3A3390F6 | SHA256:83FAAF94C22C9577E122922FDC41F9293EF06858DA4E1C33CA5067DD73EC40D6 | |||
3480 | setup.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FE | binary | |
MD5:E4DEEAF2CEA70F186D3DDAD7C8A4FA40 | SHA256:CAB9B91070F5C99EA1AE4C3D876816DCF8BB563EBCFC12032B6B11350B801A7D | |||
788 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | dbf | |
MD5:446DD1CF97EABA21CF14D03AEBC79F27 | SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF | |||
3212 | powershell.exe | C:\Users\admin\AppData\Local\Temp\yissdlmn.gau.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
788 | powershell.exe | C:\Users\admin\AppData\Local\Temp\ea11wc1f.bbj.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3480 | setup.exe | HEAD | 200 | 8.253.95.117:80 | http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v64_16.0.14332.20416.cab | US | — | — | whitelisted |
3480 | setup.exe | HEAD | 200 | 8.253.95.117:80 | http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v64_16.0.14332.20416.cab | US | — | — | whitelisted |
868 | svchost.exe | HEAD | 200 | 8.253.95.117:80 | http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v64_16.0.14332.20416.cab | US | — | — | whitelisted |
3480 | setup.exe | GET | 200 | 2.19.126.97:80 | http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl | DE | der | 557 b | whitelisted |
868 | svchost.exe | GET | 200 | 8.253.95.117:80 | http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v64_16.0.14332.20416.cab | US | compressed | 10.7 Kb | whitelisted |
3480 | setup.exe | GET | 200 | 2.19.126.97:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | DE | der | 555 b | whitelisted |
3480 | setup.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?90cf87e136323a52 | US | compressed | 4.70 Kb | whitelisted |
3480 | setup.exe | GET | 200 | 104.79.89.142:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl | US | der | 1.56 Kb | whitelisted |
868 | svchost.exe | HEAD | 200 | 8.253.95.117:80 | http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v64_16.0.14332.20416.cab | US | binary | 1 b | whitelisted |
3480 | setup.exe | GET | 200 | 2.19.126.97:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | DE | der | 824 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3480 | setup.exe | 8.253.95.117:80 | officecdn.microsoft.com | LEVEL3 | US | unknown |
3480 | setup.exe | 52.109.77.1:443 | nexusrules.officeapps.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | suspicious |
868 | svchost.exe | 8.253.95.117:80 | officecdn.microsoft.com | LEVEL3 | US | unknown |
1376 | svchost.exe | 20.50.201.195:443 | vortex-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | suspicious |
3480 | setup.exe | 52.109.88.33:443 | mrodevicemgr.officeapps.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | suspicious |
3480 | setup.exe | 52.113.194.132:443 | ecs.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | suspicious |
3480 | setup.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
3480 | setup.exe | 2.19.126.97:80 | crl.microsoft.com | Akamai International B.V. | DE | suspicious |
1376 | svchost.exe | 40.79.189.59:443 | vortex-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | JP | whitelisted |
— | — | 20.189.173.4:443 | vortex-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | suspicious |
Domain | IP | Reputation |
---|---|---|
nexusrules.officeapps.live.com |
| whitelisted |
ecs.office.com |
| whitelisted |
vortex-win.data.microsoft.com |
| whitelisted |
mrodevicemgr.officeapps.live.com |
| whitelisted |
officecdn.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
nexus.officeapps.live.com |
| whitelisted |