File name: | 0756523b7c23e94df7c960505b0a3960.exe |
Full analysis: | https://app.any.run/tasks/bdae2367-867f-44d7-8b8b-c40f9d582deb |
Verdict: | Malicious activity |
Analysis date: | May 18, 2024, 00:17:10 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 0756523B7C23E94DF7C960505B0A3960 |
SHA1: | F23A183A007B120C8AFE448F04503C9D6BBB22B3 |
SHA256: | 1DCA89A471EFA9F745D1AC0F0937BF4E7C5E168867AB57112E7736204C8DF5F6 |
SSDEEP: | 12288:0e/vK1rLgat877eFp3IDvSbh5nPYERmmRQzDdcti7D:0e/vK1rLgat8+Fp3lz1pRQzDv |
.dll | | | Win32 Dynamic Link Library (generic) (38.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (26.3) |
.exe | | | Clipper DOS Executable (11.7) |
.exe | | | Generic Win/DOS Executable (11.7) |
.exe | | | DOS Executable Generic (11.6) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2015:01:27 03:56:27+00:00 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 45056 |
InitializedDataSize: | 4096 |
UninitializedDataSize: | 106496 |
EntryPoint: | 0x24640 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
72 | c:\047730.exe | C:\047730.exe | oq44d.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
72 | c:\71ikg.exe | C:\71ikg.exe | — | b626x.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
72 | c:\a9mkx.exe | C:\a9mkx.exe | — | xf84n8.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
72 | c:\5kjtxx.exe | C:\5kjtxx.exe | — | 64gm4.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
232 | c:\6vak66.exe | C:\6vak66.exe | — | 1wv00t.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
232 | c:\60598xw.exe | C:\60598xw.exe | — | 2h0f2ns.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
232 | c:\tk5773t.exe | C:\tk5773t.exe | — | 5n495.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
232 | c:\9whn715.exe | C:\9whn715.exe | — | 57ib35.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
232 | c:\81nnm3.exe | C:\81nnm3.exe | — | 5mk41.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
308 | c:\9a872n5.exe | C:\9a872n5.exe | b6gq3ow.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
|
(PID) Process: | (6452) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (6452) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (6452) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (6452) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6452 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | — | |
MD5:— | SHA256:— | |||
6452 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_n1fsbu2x.dnm.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6452 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZB2XBJTRX0FMC9IKIDNJ.temp | binary | |
MD5:FD66A8C91EE579CC27D71698BA71070C | SHA256:D5917D811D2CF8015EEB49FF6146C30203FC98417AD82E6A095CDE277E0E0D3B | |||
6772 | 9g8r0e.exe | C:\e73l78o.exe | executable | |
MD5:10A0C39BE4C21FAF470FD4BE428C15F3 | SHA256:FBC8E3755DEBCDBFD5746CB87953AE5582D5C1693F279413B88DC8F60D383A46 | |||
6452 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF113277.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 | |||
6452 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r0mn0s4m.qm4.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
6792 | e73l78o.exe | C:\fo52564.exe | executable | |
MD5:99F5F2158DB027CE0F035E7FBE9CDE02 | SHA256:48D2408C06C290450C80660E12999C45A052605C7FAF0CCD49B371EAE21E212F | |||
6452 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:59DE938D609B33910419EC76E8E03AD6 | SHA256:0365A5133093F04B79C6C373BD820BDFBD669555E3942B79A1C077B7CF2D1FDD | |||
6896 | 305kc.exe | C:\n815hx0.exe | executable | |
MD5:14C3422537251CCCFDD89A4A8A410072 | SHA256:F90BB6CFD0784A8096C83B859828C62D5B086F0353618A7C3074396CF0BFA4C1 | |||
6832 | 9cj64i.exe | C:\9uq99.exe | executable | |
MD5:C6F64FB8CC993AA7B81E42CC2B630343 | SHA256:B15598B3EDE5E2277AD51B114259B605298713D827D24974A6D3C55EC7EC76C2 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5952 | svchost.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | — |
4232 | RUXIMICS.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | — |
5140 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.120:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | — |
4232 | RUXIMICS.exe | GET | 200 | 88.221.125.143:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | — |
5952 | svchost.exe | GET | 200 | 88.221.125.143:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | — |
5140 | MoUsoCoreWorker.exe | GET | 200 | 88.221.125.143:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | — |
— | — | POST | 200 | 20.44.10.123:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | unknown | binary | 9 b | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4364 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
5952 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4232 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5140 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5952 | svchost.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
4232 | RUXIMICS.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5140 | MoUsoCoreWorker.exe | 2.16.164.120:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
5952 | svchost.exe | 88.221.125.143:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
4232 | RUXIMICS.exe | 88.221.125.143:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
Domain | IP | Reputation |
---|---|---|
crl.microsoft.com |
| unknown |
www.microsoft.com |
| unknown |
settings-win.data.microsoft.com |
| unknown |
self.events.data.microsoft.com |
| unknown |