File name:

Spark.exe

Full analysis: https://app.any.run/tasks/07df9c47-6a71-44e4-a54b-ecf6b03dfd72
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: August 19, 2018, 10:27:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D431F54201251619C07E4D5BF39E01CD

SHA1:

553D1AFA824C34F348F8C53D1B043D3B671D946A

SHA256:

1FABBD3D6FB5BF868EF07BE4774649C4DD3F90959EF1E4477EDD08F96DE47F03

SSDEEP:

12288:Y603nsmJ23qVLb9LB3wdqi4IZJtf7UZRq6kRRiftMBQv5HUekf:Y6Yl9LBSqef4LqQIQxs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Spark.exe (PID: 2348)
      • windefender.exe (PID: 3112)

    • Application was injected by another process

      • explorer.exe (PID: 1380)

    • Connects to CnC server

      • Spark.exe (PID: 2348)

    • Runs injected code in another process

      • windefender.exe (PID: 3112)

  • SUSPICIOUS

    • Starts itself from another location

      • Spark.exe (PID: 2348)

    • Creates files in the user directory

      • Spark.exe (PID: 2348)

    • Executable content was dropped or overwritten

      • Spark.exe (PID: 2348)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:05:23 12:51:59+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 605696
InitializedDataSize: 166400
UninitializedDataSize: -
EntryPoint: 0x486f3
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-May-2014 10:51:59
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Users\Benson\Desktop\ALIN\Source working\Debug\Spark.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 23-May-2014 10:51:59
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.textbss1]\x04
0x00001000
0x00045D31
0x00000000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.text
0x00047000
0x00093CBA
0x00093E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.52298
.rdata
0x000DB000
0x0001A98A
0x0001AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.54832
.data
0x000F6000
0x00006258
0x00003E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.6855
.idata
0x000FD000
0x0000150A
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.64407
.rsrc
0x000FF000
0x0000043C
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.14297
.reloc
0x00100000
0x00005E07
0x00006000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.16045

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
WININET.dll
urlmon.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start inject spark.exe windefender.exe explorer.exe explorer.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1380C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2348"C:\Users\admin\AppData\Local\Temp\Spark.exe" C:\Users\admin\AppData\Local\Temp\Spark.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\spark.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2404"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2676"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3112"C:\Users\admin\AppData\Roaming\Installed\windefender.exe"C:\Users\admin\AppData\Roaming\Installed\windefender.exe
Spark.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\installed\windefender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
2 502
Read events
679
Write events
1 823
Delete events
0

Modification events

(PID) Process:(2348) Spark.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
Operation:writeName:identifier
Value:
IcMloe
(PID) Process:(2348) Spark.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:windefender
Value:
C:\Users\admin\AppData\Roaming\Installed\windefender.exe
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
Value:
000000000A0000002B000000334F0400000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFE05EBC40A737D40100000000
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000004F00000071000000D0F518000A0000002B000000334F04007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E00650078006500000030D6C507399C2277A0DC5700000300006000000005000000A0DF5700A0DC570054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C507788E4D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E2070800000013000A0000002B000000334F04007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E00650078006500000030D6C507399C2277A0DC5700000300006000000005000000A0DF5700A0DC570054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C507788E4D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E2070800000013000A0000002B000000334F04007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E00650078006500000030D6C507399C2277A0DC5700000300006000000005000000A0DF5700A0DC570054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C507788E4D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E207080000001300
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jvaqbjf Rkcybere.yax
Value:
000000000A0000000000000009000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFE05EBC40A737D40100000000
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000002C000000000000002B0000000A00000000000000090000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E2070800000013000A00000000000000090000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E2070800000013000A00000000000000090000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A20100003E020000260000001B0000000E00000094D7C507DAE22775E20700008CD7C507E207080013000A001B0026003E022600E05EBC40A737D401BCD7C50757C15C75A8D7C5070CD8C50762C15C75E207080000001300
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jvaqbjf Rkcybere.yax
Value:
000000000A000000000000000A000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFE05EBC40A737D40100000000
(PID) Process:(1380) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000002C000000000000002C0000000A000000000000000A0000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A2010000CCD700000AC590087CD7C50782915975CCD7C50780D7C5072795597500000000BCAC4D02A8D7C507CD945975BCAC4D0254D8C50730A84D02E19459750000000030A84D0254D8C507B0D7C5070A000000000000000A0000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A2010000CCD700000AC590087CD7C50782915975CCD7C50780D7C5072795597500000000BCAC4D02A8D7C507CD945975BCAC4D0254D8C50730A84D02E19459750000000030A84D0254D8C507B0D7C5070A000000000000000A0000007B00390045003300390039003500410042002D0031004600390043002D0034004600310033002D0042003800320037002D003400380042003200340042003600430037003100370034007D005C005400610073006B004200610072005C00570069006E0064006F007700730020004500780070006C006F007200650072002E006C006E006B0000006C006E006B00000054D6C507DE9C2277A0DC57000000000005030000080000000D0300005CD6C507AF02000098DC570084D6C5074319597547DF57004039D2065E00000098DC570020614202AF020000B8F95875780BD406780BD40694D6C50764195975206142024039D2062CDBC507BF435975206142020000000000000000FFFFFFFF0000000000000000000000004039D2065839D2064039D2068239D20600000000000000000000000000005975D8554802103AD20678DBC507BF435975D85548020000000000000000FFFFFFFF000000000000000000000000103AD206283AD206103AD206523AD206E7130000CE9F3E0238D7C50733AB0F77CE3F7082FC0B00001027000012000000D85302006CD7C507F8AA0F77D8530200CE9F3E028CD7C50730A84D020CD8C50700000000A2010000CCD700000AC590087CD7C50782915975CCD7C50780D7C5072795597500000000BCAC4D02A8D7C507CD945975BCAC4D0254D8C50730A84D02E19459750000000030A84D0254D8C507B0D7C507
(PID) Process:(1380) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(1380) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0200000001000000000000000600000007000000030000000500000004000000FFFFFFFF
Executable files
1
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
1380explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-msdb
MD5:—
SHA256:—
2348Spark.exeC:\Users\admin\AppData\Roaming\ntkrnlbinary
MD5:430AC646952B2DAA81792F397C4A4134
SHA256:72180326AC50E668090E0811619EA57380E855C51196DDE84F3E603D3BB17F1A
2348Spark.exeC:\Users\admin\AppData\Roaming\Installed\windefender.exeexecutable
MD5:D431F54201251619C07E4D5BF39E01CD
SHA256:1FABBD3D6FB5BF868EF07BE4774649C4DD3F90959EF1E4477EDD08F96DE47F03
2348Spark.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.datdat
MD5:D7A950FEFD60DBAA01DF2D85FEFB3862
SHA256:75D0B1743F61B76A35B1FEDD32378837805DE58D79FA950CB6E8164BFA72073A
3112windefender.exeC:\Users\admin\AppData\Roaming\ntkrnlbinary
MD5:430AC646952B2DAA81792F397C4A4134
SHA256:72180326AC50E668090E0811619EA57380E855C51196DDE84F3E603D3BB17F1A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2348
Spark.exe
POST
404
23.253.126.58:80
http://adobeflasherup1.com/wordpress/post.php
US
—
—
malicious
2348
Spark.exe
POST
404
23.253.126.58:80
http://javaoracle2.ru/wordpress/post.php
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2348
Spark.exe
23.253.126.58:80
adobeflasherup1.com
Rackspace Ltd.
US
malicious

DNS requests

Domain
IP
Reputation
adobeflasherup1.com
  • 23.253.126.58
  • 104.239.157.210
malicious
javaoracle2.ru
  • 23.253.126.58
  • 104.239.157.210
malicious

Threats

PID
Process
Class
Message
2348
Spark.exe
A Network Trojan was detected
ET TROJAN W32/Alina.POS-Trojan Checkin
2348
Spark.exe
A Network Trojan was detected
ET TROJAN W32/Alina.POS-Trojan Checkin
2348
Spark.exe
A Network Trojan was detected
ET TROJAN X-Malware-Sinkhole Header in HTTP Response
2348
Spark.exe
A Network Trojan was detected
ET TROJAN W32/Alina.POS-Trojan Checkin
2348
Spark.exe
A Network Trojan was detected
ET TROJAN W32/Alina.POS-Trojan Checkin
2348
Spark.exe
A Network Trojan was detected
ET TROJAN X-Malware-Sinkhole Header in HTTP Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Spark.exe