File name:

1.exe

Full analysis: https://app.any.run/tasks/8fe9499b-3310-40b9-afd0-51eb2a8184de
Verdict: Malicious activity
Analysis date: November 17, 2023, 13:00:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

56E08E19FF82A944D93FEFC1011B112A

SHA1:

39C7AC391BA16BA49EB6F9FAE4CD1FC96EE252F6

SHA256:

2032BA1561FDFA8DCE836C35BC1F89AA9A806C021F1ED7F7C32324B54E450290

SSDEEP:

98304:cwqQt9B2xUAXX1hHy5ZXpN1yXwBMAg0usmz3Bn5gWuTNXDgBxKH5UTWb/3UGJmcE:9Hme

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 2212)

    • Drops the executable file immediately after the start

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

  • SUSPICIOUS

    • Base64-obfuscated command line is found

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Reads the Internet Settings

      • 1.exe (PID: 3020)
      • powershell.exe (PID: 584)
      • powershell.exe (PID: 2916)
      • updater.exe (PID: 1724)
      • powershell.exe (PID: 1092)

    • Starts POWERSHELL.EXE for commands execution

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Starts CMD.EXE for commands execution

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • BASE64 encoded PowerShell command has been detected

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 1788)
      • cmd.exe (PID: 2212)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 2212)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 2212)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 2576)
      • cmd.exe (PID: 2212)

    • Reads settings of System Certificates

      • 1.exe (PID: 3020)

    • Checks for external IP

      • 1.exe (PID: 3020)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 1724)

  • INFO

    • Checks supported languages

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Reads the computer name

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Reads the machine GUID from the registry

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • Reads Environment values

      • 1.exe (PID: 3020)

    • Creates files or folders in the user directory

      • 1.exe (PID: 3020)
      • updater.exe (PID: 1724)

    • The executable file from the user directory is run by the Powershell process

      • updater.exe (PID: 1724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win16/32 Executable Delphi generic (34.1)
.exe | Generic Win/DOS Executable (32.9)
.exe | DOS Executable Generic (32.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:11:11 15:59:18+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 11
CodeSize: 2683392
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Description...
CompanyName: Company...
FileDescription: Title...
FileVersion: 0.0.0.0
InternalName: 1.exe
LegalCopyright: Copyright...
LegalTrademarks: Trademark...
OriginalFileName: 1.exe
ProductName: Product...
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
58
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1.exe powershell.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs takeown.exe no specs icacls.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs updater.exe no specs powershell.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs dialer.exe no specs takeown.exe no specs icacls.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs dialer.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLEC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
312C:\Windows\System32\dialer.exe "kqaxbraxb"C:\Windows\System32\dialer.exe—updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Phone Dialer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dialer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
364reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
568sc stop bits C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
572sc stop wuauserv C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAaQBnAG8AIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAZwBiAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQB3ACMAPgA="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
904sc stop WaaSMedicSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
904reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
992sc stop WaaSMedicSvc C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1068SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
7 518
Read events
7 436
Write events
82
Delete events
0

Modification events

(PID) Process:(3020) 1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3020) 1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3020) 1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3020) 1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(584) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(584) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(584) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(584) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(584) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3020) 1.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
2
Suspicious files
7
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
584powershell.exeC:\Users\admin\AppData\Local\Temp\wecbswiz.lhr.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2916powershell.exeC:\Users\admin\AppData\Local\Temp\dcgkqjci.qcd.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
30201.exeC:\Users\admin\AppData\Roaming\Google\Chrome\updater.exeexecutable
MD5:56E08E19FF82A944D93FEFC1011B112A
SHA256:2032BA1561FDFA8DCE836C35BC1F89AA9A806C021F1ED7F7C32324B54E450290
584powershell.exeC:\Users\admin\AppData\Local\Temp\dhuulshm.ggu.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
584powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
1092powershell.exeC:\Users\admin\AppData\Local\Temp\rrphowub.sfw.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2916powershell.exeC:\Users\admin\AppData\Local\Temp\yy2a4exj.bpp.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1092powershell.exeC:\Users\admin\AppData\Local\Temp\jwquvuwi.ze2.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1724updater.exeC:\Users\admin\AppData\Roaming\Google\Libs\WR64.sysexecutable
MD5:0C0195C48B6B8582FA6F6373032118DA
SHA256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3020
1.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=countryCode
unknown
text
3 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3020
1.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3020
1.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
unknown
2588
dialer.exe
45.76.89.70:80
pool.hashvault.pro
AS-CHOOPA
DE
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
shared
pool.hashvault.pro
  • 95.179.241.203
  • 45.76.89.70
unknown

Threats

PID
Process
Class
Message
3020
1.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3020
1.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
324
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
No debug info