| File name: | 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe |
| Full analysis: | https://app.any.run/tasks/ee05d10a-d9a0-4aa4-80e9-ed7da580653b |
| Verdict: | Malicious activity |
| Analysis date: | May 20, 2024, 21:06:13 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS |
| MD5: | 06B0FACF85CE6CCF71CC9EA2C4B09400 |
| SHA1: | 950A3307B8CF758A82B87906DE6D0E5BBC44784B |
| SHA256: | 0A0A16E27290D72113428814B57031D8E8796888C8EBC04D0CB0FA4778ACA781 |
| SSDEEP: | 6144:apU/HtbklvrLXfGiWJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+J:ae/tI1rLXfbWJdSjylh2b77BoTMA9gXP |
| .exe | | | DOS Executable Generic (100) |
|---|
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2013:09:14 03:56:27+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 45056 |
| InitializedDataSize: | 4096 |
| UninitializedDataSize: | 106496 |
| EntryPoint: | 0x27000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 32 | c:\qk9sa.exe | C:\qk9sa.exe | xf52s.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 32 | c:\1000gnk.exe | C:\1000gnk.exe | e9f501.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 32 | c:\sp62545.exe | C:\sp62545.exe | — | 34gd5.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 32 | c:\xp23e8m.exe | C:\xp23e8m.exe | — | 7msx8h.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 32 | c:\tvre2.exe | C:\tvre2.exe | — | c7f4862.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 32 | c:\39jl47.exe | C:\39jl47.exe | — | wh6vt.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\75nx027.exe | C:\75nx027.exe | — | o0039n.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\v0i0s.exe | C:\v0i0s.exe | — | qwc5x.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\jb694.exe | C:\jb694.exe | — | 8fm675.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 232 | c:\7j7o93.exe | C:\7j7o93.exe | — | 6m7knj.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| (PID) Process: | (1364) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1364) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1364) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1364) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1364 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G0HD1QR93QLYPYMFT6UY.temp | — | |
MD5:— | SHA256:— | |||
| 1364 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4zy1bsql.qcz.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1364 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:8D20B0FF17269920B989C0FB04BED29F | SHA256:0C1F812EEA4979679E936E572B4F70ACD5FCF9F38D04C229D27DF55499B18895 | |||
| 1364 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:E4EF274BF575FD6B8ECA28711D779AC0 | SHA256:F8745C2B495F9AC3ABCAD106DBD703383DAF8F54927D4A682DEC64EC3B28FE3B | |||
| 5256 | 930huc.exe | C:\cf1o16.exe | executable | |
MD5:12C76AC43242FD092F4D309BBE72CFAB | SHA256:5ABDE625995372DA3C299AF053A98BB5E5C3B571C2A874C17F20F2823186AA1E | |||
| 5720 | 815h0hf.exe | C:\jo1ms.exe | executable | |
MD5:A8E15818FA061673C8BE4DB7BA8A36C4 | SHA256:E363AC95FE9E95E1A4E745CAB591E5116F242C9DBE44A8F09D146B773B378E7F | |||
| 4536 | qorerwp.exe | C:\nb2xc0.exe | executable | |
MD5:364258E2B82C398A4F20E709B5AB6F4D | SHA256:759324800EBF92329B06192F770B268D79527AC65DE5D820C74825CC79517CC6 | |||
| 4944 | jo1ms.exe | C:\njhd4.exe | executable | |
MD5:FF1E9F8B97C96C8B1538469ED7F35882 | SHA256:4417060C4AECBB0922AE1012433FEDE09717B3D7E1213651C43453B43A847EED | |||
| 1788 | 2c5h94e.exe | C:\5i9mp.exe | executable | |
MD5:1F04A84E65CDE5FA9AFDCF0DAF68B1B0 | SHA256:8AE1BA05323D499187CCA10B240FDCC6899646C30687F301C250D836D3913646 | |||
| 5752 | xj23h.exe | C:\2c5h94e.exe | executable | |
MD5:51E042219D936BC3C414086720F537EB | SHA256:25992F2C2E107A4A4E0867C63D5C67B4A179742D98983E7F9DB0C740FE2AFBB0 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5256 | RUXIMICS.exe | GET | 200 | 23.216.154.115:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
3396 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5140 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
5140 | MoUsoCoreWorker.exe | GET | 200 | 23.216.154.115:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
5256 | RUXIMICS.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
3396 | svchost.exe | GET | 200 | 23.216.154.115:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
— | — | POST | 200 | 20.42.73.30:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | binary | 9 b | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3396 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5256 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5140 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
3396 | svchost.exe | 23.216.154.115:80 | crl.microsoft.com | Akamai International B.V. | IE | unknown |
5256 | RUXIMICS.exe | 23.216.154.115:80 | crl.microsoft.com | Akamai International B.V. | IE | unknown |
5140 | MoUsoCoreWorker.exe | 23.216.154.115:80 | crl.microsoft.com | Akamai International B.V. | IE | unknown |
3396 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
5256 | RUXIMICS.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
5140 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |