File name:

Sample2.exe

Full analysis: https://app.any.run/tasks/f3143223-c479-47ca-bd00-2d2f712bbcaa
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 03, 2024, 00:59:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sinkhole
shiz
trojan
simda
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B4E2C49803590B0C9EE40F27EDC79176

SHA1:

8A185D3F60F4B64545F3A4D19BB5FB972145DD05

SHA256:

1F86759CEC94A7FC427DD9DEC190BE256BC31AB58C9DF3E3281F463DB68E6AE7

SSDEEP:

49152:vcSX6SyhsDfvBgJcSX6SyhsDfvBgJcSX6SyhsDfvBg8:TX6SygfmNX6SygfmNX6Sygfm8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Sample2.exe (PID: 1604)

    • Runs injected code in another process

      • Sample2.exe (PID: 1604)
      • explorer.exe (PID: 1164)

    • Application was injected by another process

      • explorer.exe (PID: 1164)
      • ctfmon.exe (PID: 1564)
      • dwm.exe (PID: 612)
      • taskeng.exe (PID: 300)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1164)

    • SHIZ has been detected (SURICATA)

      • explorer.exe (PID: 1164)

    • Connects to the CnC server

      • explorer.exe (PID: 1164)

    • SIMDA has been detected (SURICATA)

      • explorer.exe (PID: 1164)

  • SUSPICIOUS

    • The process checks if it is being run in the virtual environment

      • Sample2.exe (PID: 1604)
      • explorer.exe (PID: 1164)

    • The process verifies whether the antivirus software is installed

      • Sample2.exe (PID: 1604)

  • INFO

    • Checks supported languages

      • Sample2.exe (PID: 1604)

    • Reads the computer name

      • Sample2.exe (PID: 1604)

    • Checks proxy server information

      • explorer.exe (PID: 1164)

    • Reads the Internet Settings

      • explorer.exe (PID: 1164)

    • Create files in a temporary directory

      • explorer.exe (PID: 1164)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1164)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1164)

    • Reads settings of System Certificates

      • explorer.exe (PID: 1164)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:08:02 11:26:00+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 11264
InitializedDataSize: 366592
UninitializedDataSize: -
EntryPoint: 0x2b70
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
inject start inject inject sample2.exe no specs #SHIZ explorer.exe dwm.exe ctfmon.exe taskeng.exe

Process information

PID
CMD
Path
Indicators
Parent process
300taskeng.exe {CE1452CD-5E82-4DCD-B0CC-498574D17563}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
612"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1164C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1564C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1604"C:\Users\admin\AppData\Local\Temp\Sample2.exe" C:\Users\admin\AppData\Local\Temp\Sample2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sample2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
8 419
Read events
8 406
Write events
13
Delete events
0

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:userinit
Value:
C:\Users\admin\AppData\Local\Temp\Sample2.exe
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
4EF0A23C3C56DA01
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadNetworkName
Value:
Network 3
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionTime
Value:
4EF0A23C3C56DA01
(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecision
Value:
0
Executable files
1
Suspicious files
16
Text files
34
Unknown types
1

Dropped files

PID
Process
Filename
Type
1164explorer.exeC:\Users\admin\AppData\Local\Temp\451F.tmphtml
MD5:1AE8CE2D329E3997498B900A48AB6045
SHA256:3CED978F14628FBF27930CE5C6FB14942943EE247334A80FC8FC19AE0E502D0C
1164explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\8SQP1GOJ.txttext
MD5:402839F58C16FC0254C64A56E24E6D84
SHA256:348AB493B414F2C9E253F81C394F06F9613E900C9ECF97D531A036D0316C1636
1164explorer.exeC:\Users\admin\AppData\Local\Temp\Sample2.exeexecutable
MD5:B4E2C49803590B0C9EE40F27EDC79176
SHA256:1F86759CEC94A7FC427DD9DEC190BE256BC31AB58C9DF3E3281F463DB68E6AE7
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:230436FC402A027155E3213D5785C3BA
SHA256:7BF515F114D9386F1071E63A484D2E65051CC6432343FCFB7232EFFDDC795070
1164explorer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:0FC33B12EB8AF9F02D99C0ED1716D478
SHA256:6B03E64BAABF52C58C4B1E981EBEC59075465BF1DB3167F0FAE47C10D1BB580E
1164explorer.exeC:\Users\admin\AppData\Local\Temp\4530.tmphtml
MD5:F2A92E633518E9A6E9C46CE48398B5EB
SHA256:6E777D812A2BE3117C1FF478A324CB08DF41FE80BD585242BE15CB0A52502F47
1164explorer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\HMVQR6X1.htmhtml
MD5:F2A92E633518E9A6E9C46CE48398B5EB
SHA256:6E777D812A2BE3117C1FF478A324CB08DF41FE80BD585242BE15CB0A52502F47
1164explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\IJNLHI2N.txttext
MD5:A8AAF9BE985D14BFE86D7B8A0C863B60
SHA256:11F4D1147EA4A2472A0B0C4E69F5A56C66F450F343F9C1677DDE44AE18204639
1164explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\1YWRISTC.txttext
MD5:0BDD682EAC91F27A8C61FFE02065C0EA
SHA256:E19F7A67880AEC0BF4D88BA30B153A5323E9E510B64DD9BE432BD432948A35BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
52
DNS requests
357
Threats
71

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1164
explorer.exe
GET
200
64.190.63.111:80
http://galyqaz.com/login.php
unknown
html
22.9 Kb
unknown
1164
explorer.exe
GET
301
13.248.169.48:80
http://pupydeq.com/login.php
unknown
—
—
unknown
1164
explorer.exe
GET
302
95.211.219.65:80
http://lysyfyj.com/login.php
unknown
text
11 b
unknown
1164
explorer.exe
GET
301
188.114.96.3:80
http://qegyhig.com/login.php
unknown
html
162 b
unknown
1164
explorer.exe
GET
302
72.52.178.23:80
http://vojyqem.com/login.php
unknown
—
—
unknown
1164
explorer.exe
GET
302
162.255.119.102:80
http://gahyqah.com/login.php
unknown
html
55 b
unknown
1164
explorer.exe
GET
200
34.174.61.199:80
http://qetyfuv.com/login.php
unknown
—
—
unknown
1164
explorer.exe
GET
404
208.100.26.245:80
http://lyvyxor.com/login.php
unknown
html
580 b
unknown
1164
explorer.exe
GET
200
34.174.61.199:80
http://vocyzit.com/login.php
unknown
—
—
unknown
1164
explorer.exe
GET
200
13.248.148.254:80
http://ww12.vojyqem.com/login.php?usid=18&utid=24117601311
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1164
explorer.exe
2.23.209.187:80
www.bing.com
Akamai International B.V.
GB
unknown
1164
explorer.exe
188.114.96.3:80
qegyhig.com
CLOUDFLARENET
NL
unknown
1164
explorer.exe
162.255.119.102:80
gahyqah.com
NAMECHEAP-NET
US
unknown
1164
explorer.exe
64.190.63.111:80
galyqaz.com
SEDO GmbH
DE
unknown
1164
explorer.exe
72.52.178.23:80
vojyqem.com
LIQUIDWEB
US
unknown
1164
explorer.exe
95.211.219.65:80
lysyfyj.com
LeaseWeb Netherlands B.V.
NL
unknown
1164
explorer.exe
34.174.61.199:80
qetyfuv.com
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.133
whitelisted
gatyfus.com
  • 162.249.66.86
malicious
lyvyxor.com
  • 208.100.26.245
unknown
gaqydeb.com
  • —
unknown
vojyqem.com
  • 72.52.178.23
unknown
qetyfuv.com
  • 34.174.61.199
unknown
lyryfyd.com
  • —
unknown
purydyv.com
  • —
unknown
puvyxil.com
  • —
unknown
gahyqah.com
  • 162.255.119.102
  • 23.253.46.64
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Wapack Labs Sinkhole DNS Reply
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Wapack Labs Sinkhole DNS Reply
1164
explorer.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
1164
explorer.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1164
explorer.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.
1164
explorer.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1164
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
1164
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1164
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
1164
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
58 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sample2.exe