analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SophosTester_Unsigned.exe

Full analysis: https://app.any.run/tasks/635eec41-673a-465b-bdfe-37071cc9d34a
Verdict: Malicious activity
Analysis date: October 05, 2022, 07:52:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CC6518388AEB4C42869A480A914618FF

SHA1:

48E8914CC9761544662BA6AF887EA48B64E16FFB

SHA256:

0BB076AE9E746C20794CCEEF4800CD093F24A3CEA759584BE9D80344F09F04FA

SSDEEP:

24576:pmTM2aPhtL7YPvF1t5tXaYdQ72YQ/LMyKfjX8J0:K5+htL7Y1SY272F5CjXi0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates a writable file the system directory

      • SophosTester_Unsigned.exe (PID: 1984)
    • Loads dropped or rewritten executable

      • SophosTester_Unsigned.exe (PID: 2260)
      • SophosTester_Unsigned.exe (PID: 1504)
      • SophosTester_Unsigned.exe (PID: 3124)
      • SophosTester_Unsigned.exe (PID: 2296)
      • SophosTester_Unsigned.exe (PID: 4068)
      • SophosTester_Unsigned.exe (PID: 3712)
  • SUSPICIOUS

    • Application launched itself

      • SophosTester_Unsigned.exe (PID: 2492)
      • SophosTester_Unsigned.exe (PID: 1984)
    • Reads Internet Settings

      • SophosTester_Unsigned.exe (PID: 2492)
    • Creates a directory in Program Files

      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates files in the driver directory

      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates files in the Windows directory

      • SophosTester_Unsigned.exe (PID: 1984)
    • Executable content was dropped or overwritten

      • SophosTester_Unsigned.exe (PID: 1984)
    • Drops a file that was compiled in debug mode

      • SophosTester_Unsigned.exe (PID: 1984)
    • Reads the machine GUID from the registry

      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates a software uninstall entry

      • SophosTester_Unsigned.exe (PID: 1984)
  • INFO

    • Checks supported languages

      • SophosTester_Unsigned.exe (PID: 2492)
      • SophosTester_Unsigned.exe (PID: 1984)
      • SophosTester_Unsigned.exe (PID: 2260)
      • SophosTester_Unsigned.exe (PID: 1504)
      • SophosTester_Unsigned.exe (PID: 3124)
      • SophosTester_Unsigned.exe (PID: 2296)
      • SophosTester_Unsigned.exe (PID: 3712)
      • SophosTester_Unsigned.exe (PID: 4068)
    • Reads the computer name

      • SophosTester_Unsigned.exe (PID: 2492)
      • SophosTester_Unsigned.exe (PID: 1984)
      • SophosTester_Unsigned.exe (PID: 2260)
      • SophosTester_Unsigned.exe (PID: 1504)
      • SophosTester_Unsigned.exe (PID: 2296)
      • SophosTester_Unsigned.exe (PID: 3124)
      • SophosTester_Unsigned.exe (PID: 3712)
      • SophosTester_Unsigned.exe (PID: 4068)
    • Process checks LSA protection

      • SophosTester_Unsigned.exe (PID: 2492)
      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates files in the program directory

      • SophosTester_Unsigned.exe (PID: 1984)
    • Reads product name

      • SophosTester_Unsigned.exe (PID: 1984)
    • Reads Environment values

      • SophosTester_Unsigned.exe (PID: 1984)
    • Creates files in the user directory

      • SophosTester_Unsigned.exe (PID: 2260)
      • SophosTester_Unsigned.exe (PID: 3124)
      • SophosTester_Unsigned.exe (PID: 3712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2019-Nov-25 11:43:15
Detected languages:
  • English - United Kingdom
  • English - United States
Debug artifacts:
  • C:\ForJenkins\BaseFolder\xpd\HitmanPro.Alert\Alert\bin\Release\SophosTester.pdb
CompanyName: Threatstar B.V.
FileDescription: Sophos Tester
FileVersion: 3.7.15.639
LegalCopyright: © 2016-2019 Threatstar, A Sophos Company
OriginalFilename: sophostester.exe
ProductName: Sophos Tester
ProductVersion: 3.7.15.639
SpecialBuild: BETA

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 264

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2019-Nov-25 11:43:15
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
396896
397312
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5912
.rdata
401408
134320
134656
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.74881
.data
536576
15656
11264
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.7791
.rsrc
552960
654008
654336
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.4378
.reloc
1208320
22816
23040
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61317

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.97582
24972
UNKNOWN
UNKNOWN
RT_ICON
2
2.76878
67624
UNKNOWN
UNKNOWN
RT_ICON
3
3.44537
38056
UNKNOWN
UNKNOWN
RT_ICON
4
3.76585
16936
UNKNOWN
UNKNOWN
RT_ICON
5
4.15174
9640
UNKNOWN
UNKNOWN
RT_ICON
6
4.56752
4264
UNKNOWN
UNKNOWN
RT_ICON
7
5.14908
2440
UNKNOWN
UNKNOWN
RT_ICON
8
5.68898
1128
UNKNOWN
UNKNOWN
RT_ICON
100
2.97321
118
UNKNOWN
UNKNOWN
RT_GROUP_ICON
200
7.99921
260845
UNKNOWN
UNKNOWN
RT_RCDATA

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
imagehlp.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start sophostester_unsigned.exe no specs sophostester_unsigned.exe sophostester_unsigned.exe no specs sophostester_unsigned.exe no specs sophostester_unsigned.exe no specs sophostester_unsigned.exe no specs sophostester_unsigned.exe no specs sophostester_unsigned.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2492"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" C:\Users\admin\Desktop\SophosTester_Unsigned.exeExplorer.EXE
User:
admin
Company:
Threatstar B.V.
Integrity Level:
MEDIUM
Description:
Sophos Tester
Exit code:
4
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1984"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /elevatedC:\Users\admin\Desktop\SophosTester_Unsigned.exe
SophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
2260"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1504"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3124"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2296"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3712"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
4068"C:\Users\admin\Desktop\SophosTester_Unsigned.exe" /targetC:\Users\admin\Desktop\SophosTester_Unsigned.exeSophosTester_Unsigned.exe
User:
admin
Company:
Threatstar B.V.
Integrity Level:
HIGH
Description:
Sophos Tester
Exit code:
0
Version:
3.7.15.639
Modules
Images
c:\users\admin\desktop\sophostester_unsigned.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
797
Read events
778
Write events
19
Delete events
0

Modification events

(PID) Process:(2492) SophosTester_Unsigned.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2492) SophosTester_Unsigned.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2492) SophosTester_Unsigned.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2492) SophosTester_Unsigned.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:DisplayName
Value:
Sophos Tester 3
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:DisplayVersion
Value:
3.7.15.639
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Sophos\Sophos Tester\SophosTester.exe
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:InstallLocation
Value:
C:\Program Files\Sophos\Sophos Tester
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:NoModify
Value:
1
(PID) Process:(1984) SophosTester_Unsigned.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sophos Tester
Operation:writeName:NoRepair
Value:
1
Executable files
4
Suspicious files
9
Text files
32
Unknown types
1

Dropped files

PID
Process
Filename
Type
2260SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_00.rtftext
MD5:1A5F9857E7B27A2EE856AE4A91B43F32
SHA256:C8D046F8F00345B96A5E516C7F97261B5DF71050CF418AD49A50A88476EE4EB5
2260SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_04.rtftext
MD5:D97DED493F977D1BC4BA82446026A43F
SHA256:D78E8D25532045390CAE16D373B9E77870FD2CFE5C6B4919480DCD5F74F8A523
1984SophosTester_Unsigned.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos Tester\Sophos Tester.lnklnk
MD5:AE9B8936A6C5F1B9385EB962F612D98D
SHA256:9F0CC605A4AE3ED7C09350964BEB740E002A5E5ED921D30E324E6AAAFC2DCAD5
1984SophosTester_Unsigned.exeC:\Program Files\Sophos\Sophos Tester\helper.exeexecutable
MD5:988E2C09A85BFFB8387E44C7DC9E6747
SHA256:68BCE3FCB425D55315BB3A450048AF8E4C345CAC39E275B29886FA8A6A522DB2
1984SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Temp\SophosTester-install.logbinary
MD5:E78E3C557BE90593B16A0E262D2D3153
SHA256:BD96B70D54450CF1CC0EA471BEF582F23F63D27B921AE03772B330B87057FF66
2260SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_01.rtftext
MD5:D2EBBBF0D0A48C5550DB6FFE11A710EB
SHA256:DC659EE784AE9E6AB2D8DF2337A6FA4B6DBB84F5F64D3C41513DCE39FC596471
2260SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_02.rtftext
MD5:7CB273FC6E80B058C511B51726C39944
SHA256:04DD71C38A27C3BD5B5EBEB45156A5FAA203BD261B8737F5D67BA828626896CE
2260SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_05.rtftext
MD5:C6306F4F44AFC9C78BD1A42B7266EA0B
SHA256:CBD0ACE234B13CCC1463CED6BA00CB48F7ABF708BEC70E378041181CFC0E6B5E
3124SophosTester_Unsigned.exeC:\Users\admin\AppData\Local\Sophos Tester\CryptoLocker\test_00.rtftext
MD5:98BB8BA9346A0D7974E705F53671570A
SHA256:CDEB4D10632311B17F704DC9BD35659A21D234B64DAC4BFEFB86DCE68571FC3D
1984SophosTester_Unsigned.exeC:\Windows\system32\drivers\tester86.sysexecutable
MD5:F6DFD1189C1470AEA46FAB5D1EC8120D
SHA256:E77482AF6B56D755A4787D75176A3ED4056FEDD0DD1F410471A936107E149C4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info