File name:

file

Full analysis: https://app.any.run/tasks/6db6cec4-bea6-41c8-9954-2f1c5bc13114
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 21:59:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
ransomware
stop
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F34D65E086D788C5E64A978CAE47A05A

SHA1:

C1F204C32C053D418601AF06E263B96CE5945C50

SHA256:

0B2439F17898FD862D504477A5A0A2F7AE332E5744E9DCB884FD68A1074B017E

SSDEEP:

24576:qV7T9ZYUCBHM5T3lsmqZ6LqXRTLgIum25Gik1ibTxqymwnXxxyEBSqJ:qV/9ZiBHM5T3lsmqZAqXRTLgIum25Gin

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 2128)

    • Stop is detected

      • file.exe (PID: 972)

  • SUSPICIOUS

    • Application launched itself

      • file.exe (PID: 1584)
      • file.exe (PID: 2128)
      • file.exe (PID: 2072)

    • Checks Windows Trust Settings

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Reads settings of System Certificates

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Reads the Internet Settings

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Uses ICACLS.EXE to modify access control lists

      • file.exe (PID: 2128)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

  • INFO

    • Checks supported languages

      • file.exe (PID: 2128)
      • file.exe (PID: 1584)
      • file.exe (PID: 2072)
      • file.exe (PID: 972)

    • Reads the computer name

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Checks proxy server information

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Creates files or folders in the user directory

      • file.exe (PID: 2128)
      • file.exe (PID: 972)

    • Reads the machine GUID from the registry

      • file.exe (PID: 2128)
      • file.exe (PID: 972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:06 14:27:57+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 95744
InitializedDataSize: 4375552
UninitializedDataSize: -
EntryPoint: 0x898e
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 21.0.0.0
ProductVersionNumber: 34.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0373)
CharacterSet: Unknown (63B6)
FileDescriptions: Vellting
InternalName: Bastard.exe
LegalTrademark1: Fractal
OriginalFileName: Lameros.exe
ProductName: Jadocka
ProductVersion: 57.38.26
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe no specs file.exe icacls.exe no specs file.exe #STOP file.exe

Process information

PID
CMD
Path
Indicators
Parent process
972"C:\Users\admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\file.exe
file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1584"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2072"C:\Users\admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\AppData\Local\Temp\file.exe
file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2128"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
file.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2796icacls "C:\Users\admin\AppData\Local\01dfbc8c-6ed9-4064-976c-4129b52c1458" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\SysWOW64\icacls.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 191
Read events
2 157
Write events
34
Delete events
0

Modification events

(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2128) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2128) file.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(972) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
1
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2128file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\geo[1].jsontext
MD5:ED8DCEBBE9E07BA630BF9A8BA3563656
SHA256:E953A33FD7466070323ACC7930B2A55F3792B8B0A40DBD65F2C5B991D6D78CE6
972file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\geo[1].jsontext
MD5:69480241873C193A0CFB17CBECFC50D7
SHA256:0107C2C5204AD9B721394A330A102DE77E99D4DB10EC6BBD60EC09A36C9A045F
972file.exeC:\SystemID\PersonalID.txttext
MD5:8C373757B8C71EB82855156CEB3C3E98
SHA256:1380327DBE1570EE60BDDA2CFAD3CA30770476F216D98052E98AF6C1EAC94E77
2128file.exeC:\Users\admin\AppData\Local\01dfbc8c-6ed9-4064-976c-4129b52c1458\file.exeexecutable
MD5:F34D65E086D788C5E64A978CAE47A05A
SHA256:0B2439F17898FD862D504477A5A0A2F7AE332E5744E9DCB884FD68A1074B017E
972file.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\get[1].htmbinary
MD5:3E6019360563C67673947EEA2E8F01B3
SHA256:6ECD922C6ACAA519096C13717C7D9C83CBDA564FB0114C9E0014CFD675BD27DF
972file.exeC:\Users\admin\AppData\Local\bowsakkdestx.txtbinary
MD5:3E6019360563C67673947EEA2E8F01B3
SHA256:6ECD922C6ACAA519096C13717C7D9C83CBDA564FB0114C9E0014CFD675BD27DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
2
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
972
file.exe
GET
200
175.126.109.15:80
http://zexeq.com/test2/get.php?pid=D2A34488191DA742578166D02E2C8607&first=true
unknown
binary
557 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2128
file.exe
188.114.96.3:443
api.2ip.ua
CLOUDFLARENET
NL
unknown
972
file.exe
188.114.96.3:443
api.2ip.ua
CLOUDFLARENET
NL
unknown
972
file.exe
175.126.109.15:80
zexeq.com
SK Broadband Co Ltd
KR
unknown

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 188.114.96.3
  • 188.114.97.3
shared
zexeq.com
  • 175.126.109.15
  • 175.119.10.231
  • 190.187.52.42
  • 95.86.30.3
  • 211.168.53.110
  • 196.188.169.138
  • 190.219.136.87
  • 109.175.29.39
  • 187.209.155.200
  • 95.158.162.200
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2128
file.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
972
file.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
972
file.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
972
file.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
972
file.exe
A Network Trojan was detected
ET MALWARE Win32/Filecoder.STOP Variant Public Key Download
1 ETPRO signatures available at the full report
No debug info