File name: | Antivirus_Installer.exe |
Full analysis: | https://app.any.run/tasks/ad931039-73a7-4ed2-b2d3-6b3cde21f95a |
Verdict: | Malicious activity |
Analysis date: | June 27, 2022, 13:47:51 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386, for MS Windows |
MD5: | 70EC6F9BEC87D67C435A2B8505A72629 |
SHA1: | 8DAE4C1727C73B3C1135B633E4DB69E60ED522F1 |
SHA256: | 1BFEF2733F357E531BE53B406B65661893B97A8B18A699B6E65F201DD0EEEAE8 |
SSDEEP: | 1536:X7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfrwFOO:L7DhdC6kzWypvaQ0FxyNTBfrS |
.exe | | | Win32 Executable MS Visual C++ (generic) (41) |
---|---|---|
.exe | | | Win64 Executable (generic) (36.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.6) |
.exe | | | Win32 Executable (generic) (5.9) |
.exe | | | Win16/32 Executable Delphi generic (2.7) |
Subsystem: | Windows command line |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x1000 |
UninitializedDataSize: | - |
InitializedDataSize: | 19968 |
CodeSize: | 70656 |
LinkerVersion: | 2.5 |
PEType: | PE32 |
TimeStamp: | 2019:07:30 10:52:45+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 30-Jul-2019 08:52:45 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 30-Jul-2019 08:52:45 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.code | 0x00001000 | 0x0000387E | 0x00003A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.52922 |
.text | 0x00005000 | 0x0000D962 | 0x0000DA00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.56249 |
.rdata | 0x00013000 | 0x000033A5 | 0x00003400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.11184 |
.data | 0x00017000 | 0x0000178C | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.1006 |
.rsrc | 0x00019000 | 0x00000778 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.55839 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.92322 | 611 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
0C4DD77751D9B5722E237FF3300415D7 | 3.23593 | 14 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
6EE0CFDA156871C4C500FA22141F9DA2 | 7.68982 | 715 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
7CCF54229D | 0 | 1 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
9D0EB545293D68BF4DCEE199C5D67F8723D7A54A | 4.4183 | 24 | Latin 1 / Western European | UNKNOWN | RT_RCDATA |
COMCTL32.DLL |
GDI32.DLL |
KERNEL32.dll |
MSVCRT.dll |
OLE32.DLL |
SHELL32.DLL |
SHLWAPI.DLL |
USER32.DLL |
WINMM.DLL |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2924 | "C:\Users\admin\AppData\Local\Temp\Antivirus_Installer.exe" | C:\Users\admin\AppData\Local\Temp\Antivirus_Installer.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
3548 | "C:\Users\admin\AppData\Local\Temp\Antivirus_Installer.exe" | C:\Users\admin\AppData\Local\Temp\Antivirus_Installer.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
3500 | "C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\D5F4.tmp\D5F5.tmp\D5F6.bat C:\Users\admin\AppData\Local\Temp\Antivirus_Installer.exe" | C:\Windows\system32\cmd.exe | — | Antivirus_Installer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3172 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=oAkRBqxm8tM | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2460 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=lPySS7mt4eo | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
928 | "C:\Program Files\Internet Explorer\iexplore.exe" http://custom-gwent.com/cardsBg/1efae8b0c69810654f16b400426049fd.jpeg | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3092 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.protegent360.com/softwares/PAVSetup.exe | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3448 | "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=ymbw2R3uIqc | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3852 | "C:\Program Files\Internet Explorer\iexplore.exe" https://files.fm/f/hfkwsdkmj | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2280 | "C:\Program Files\Internet Explorer\iexplore.exe" http://download2389.mediafire.com/xzhsf9dl17ng/9f8fds9s3efg7so/WannaCry+by+Rafael.rar | C:\Program Files\Internet Explorer\iexplore.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2192 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF8EBCD4-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:91BAFA96FB467FE05AC7CF25BBDE8BCE | SHA256:95B73F07552AFA7FA9266339539667C4FDB89CCAD6296902FE5889E24BAE4571 | |||
928 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF4CB9B8-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:4448F22F10D8F30BDF1DFF080EE629CB | SHA256:57271DE0ACCA198DFEE983D107AE119F44F4D65BE6856268B8B324AFCEB6D559 | |||
3852 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF764CBA-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:6B611C83E3A5D283C95768B4A0E953E6 | SHA256:310F64765FE228AEAC863B5C23981A9AB190E72D9E1C130B5D24D44EF1981C85 | |||
3064 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\B3XAYDE1.txt | text | |
MD5:9B5F41545992422CEECD13AE5C6DAE6C | SHA256:FDB856C2073A6D9DE1F44995D97617FA6B65E2A5D3246354A5BF3DD7C857345A | |||
2624 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF7E7ECF-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:4758CDACC4A99DA1E2AF9A7797CE4600 | SHA256:9D7E2B757FDF7CDDF43876AA2B9F2BC127ADCE3EC01CE346DAB4FBD1B29CBCF7 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | binary | |
MD5:16FEAA2334C35FE545273C5C76ACA024 | SHA256:044849AE65A17BA97A9F0C600ED19ADE3147AFF7835643C8B5018961CA914B08 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_C668445AACCF7A560A7B569C97BA4550 | binary | |
MD5:C024F39E6BB6F18CEB06A9E7A2057F65 | SHA256:72F6531443681F40ED75949DF8210665D809C359478D25CE362B5A82F295854B | |||
3448 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF692FCB-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:90239037926A214EF5621ECB322979F5 | SHA256:DF9B3ED1EE70A99323DF954F5F550FBCB69F74E75BF456D25B460071BBC0C779 | |||
2460 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF9CE4CB-F61F-11EC-B13F-12A9866C77DE}.dat | binary | |
MD5:9FE54B69AA5C504E992948C8BEB399C1 | SHA256:87698A5E0A3683EBA9B27658DFA9556C508125F336A9157A95D1270FE5BE8524 | |||
3652 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA | der | |
MD5:5A11C6099B9E5808DFB08C5C9570C92F | SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
532 | iexplore.exe | GET | 302 | 199.91.155.130:80 | http://download2389.mediafire.com/xzhsf9dl17ng/9f8fds9s3efg7so/WannaCry+by+Rafael.rar | US | — | — | suspicious |
532 | iexplore.exe | GET | 200 | 104.16.202.237:80 | http://www.mediafire.com/download_repair.php?flag=4&dkey=xzhsf9dl17n&qkey=9f8fds9s3efg7so&ip=85%2E206%2E166%2E82 | US | html | 15.1 Kb | shared |
3652 | iexplore.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFis5ZQLQXhkEp1TGjnLAGc%3D | US | der | 471 b | whitelisted |
3652 | iexplore.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCqm%2FLZVwk%2FcRLv5CtSZANu | US | der | 472 b | whitelisted |
1796 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
2680 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
3652 | iexplore.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
3652 | iexplore.exe | GET | 200 | 142.250.185.67:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
2460 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D | US | der | 1.47 Kb | whitelisted |
2088 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D | US | der | 1.47 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3676 | iexplore.exe | 172.217.18.14:443 | www.youtube.com | Google Inc. | US | whitelisted |
3652 | iexplore.exe | 172.217.18.14:443 | www.youtube.com | Google Inc. | US | whitelisted |
3064 | iexplore.exe | 172.217.18.14:443 | www.youtube.com | Google Inc. | US | whitelisted |
2408 | iexplore.exe | 158.69.193.79:80 | custom-gwent.com | OVH SAS | CA | unknown |
532 | iexplore.exe | 199.91.155.130:80 | download2389.mediafire.com | MediaFire, LLC | US | suspicious |
3076 | iexplore.exe | 67.225.178.33:443 | www.protegent360.com | Liquid Web, L.L.C | US | unknown |
2680 | iexplore.exe | 162.159.130.233:443 | cdn.discordapp.com | Cloudflare Inc | — | shared |
1796 | iexplore.exe | 104.21.42.46:443 | files.fm | Cloudflare Inc | US | suspicious |
2088 | iexplore.exe | 162.159.130.233:443 | cdn.discordapp.com | Cloudflare Inc | — | shared |
2680 | iexplore.exe | 8.249.11.254:80 | ctldl.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
www.youtube.com |
| whitelisted |
custom-gwent.com |
| unknown |
www.protegent360.com |
| unknown |
files.fm |
| whitelisted |
cdn.discordapp.com |
| shared |
download2389.mediafire.com |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discordapp .com) |
2680 | iexplore.exe | Misc activity | ET INFO Observed Discord Domain (discordapp .com in TLS SNI) |
2088 | iexplore.exe | Misc activity | ET INFO Observed Discord Domain (discordapp .com in TLS SNI) |
Process | Message |
---|---|
CPSERV~1.EXE | [MY_SERVICE] StartServiceCtrlDispatcher error = 1063
|
CPSERV~1.EXE | [MY_SERVICE] StartServiceCtrlDispatcher error = 1063
|