download:

file.exe

Full analysis: https://app.any.run/tasks/0a6d35ab-346f-4bdf-9799-5a38f344593f
Verdict: Malicious activity
Analysis date: June 25, 2019, 19:57:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

71D82B8CB31390965B54D10F796210D4

SHA1:

5F49420045F3994D8C350E3C041D0FF05F84F956

SHA256:

239205C83CDC17B4CFBFDB98217CEE68ED24902B728C052977A5FC05186F488A

SSDEEP:

384:7RqjR7cIqqMZM/gTiJFpLfB+6gFWqF+0X0N:7Ij9cIqqPK/6g1FI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Low-level write access rights to disk partition

      • file.exe (PID: 2124)

  • SUSPICIOUS

    • Application launched itself

      • file.exe (PID: 2816)

    • Starts Internet Explorer

      • file.exe (PID: 2124)

    • Low-level read access rights to disk partition

      • file.exe (PID: 2124)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1012)
      • iexplore.exe (PID: 3380)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1012)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1012)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1012)

    • Creates files in the user directory

      • iexplore.exe (PID: 1012)

    • Changes internet zones settings

      • iexplore.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:02:26 19:49:29+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 3072
InitializedDataSize: 9216
UninitializedDataSize: -
EntryPoint: 0x122d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Feb-2019 18:49:29
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 26-Feb-2019 18:49:29
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00000A94
0x00000C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.65507
.rdata
0x00002000
0x00001C0A
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.21538
.data
0x00004000
0x00000144
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.11397
.rsrc
0x00005000
0x000001E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.75077
.reloc
0x00006000
0x000001D0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.76023

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
PSAPI.DLL
SHELL32.dll
USER32.dll
WINMM.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
11
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe file.exe no specs file.exe no specs file.exe no specs file.exe no specs file.exe no specs file.exe iexplore.exe iexplore.exe control.exe no specs file.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Users\admin\AppData\Local\Temp\file.exe" /watchdogC:\Users\admin\AppData\Local\Temp\file.exe—file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
828"C:\Users\admin\AppData\Local\Temp\file.exe" /watchdogC:\Users\admin\AppData\Local\Temp\file.exe—file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1012"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3380 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2124"C:\Users\admin\AppData\Local\Temp\file.exe" /mainC:\Users\admin\AppData\Local\Temp\file.exe
file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2608"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\systemroot\system32\ntdll.dll
2704"C:\Users\admin\AppData\Local\Temp\file.exe" /watchdogC:\Users\admin\AppData\Local\Temp\file.exe—file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2816"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3032"C:\Users\admin\AppData\Local\Temp\file.exe" /watchdogC:\Users\admin\AppData\Local\Temp\file.exe—file.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3380"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3416"C:\Windows\System32\control.exe" C:\Windows\System32\control.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
897
Read events
774
Write events
121
Delete events
2

Modification events

(PID) Process:(2816) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2816) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\AdminActive
Operation:writeName:{8A79F391-9783-11E9-A09E-5254004A04AF}
Value:
0
(PID) Process:(3380) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
Executable files
0
Suspicious files
2
Text files
34
Unknown types
51

Dropped files

PID
Process
Filename
Type
3380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
3380iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\cute_trap_takes_a_big_dick[1].txt —
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\default.header.static[1].jstext
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.datdat
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\english[1].jstext
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\english[1].jstext
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\iconfont[1].eoteot
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static-egc.xvideos-cdn.com\settings.sxx —
MD5:—
SHA256:—
1012iexplore.exeC:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxxsol
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
12
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-01318270519/v3/fonts/skins/common/iconfont/iconfont.eot?itvls8
US
eot
16.1 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-6615d7c4ad3/v3/css/player/html5.css
US
text
4.84 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-ff774094674/v3/img/flags/flat/flags-32.png
US
image
29.0 Kb
suspicious
1012
iexplore.exe
GET
200
185.88.181.4:80
http://www.xvideos.com/video35484761/cute_trap_takes_a_big_dick
NL
html
17.3 Kb
whitelisted
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v3/js/skins/min/require.static.js
US
text
7.73 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v3/swf/xv-player.swf
US
swf
137 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-e03d4c06d17/v3/js/skins/min/player.html5.static.js
US
text
160 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-ff774094674/v3/css/default/main2.css
US
text
19.6 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-e1640e6cc13/v3/js/skins/min/default.header.static.js
US
text
25.7 Kb
suspicious
1012
iexplore.exe
GET
200
152.195.133.76:80
http://static-egc.xvideos-cdn.com/v-c6c7dc035f2/v3/js/skins/min/default.js
US
text
217 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1012
iexplore.exe
185.88.181.4:443
www.xvideos.com
ServerStack, Inc.
NL
suspicious
1012
iexplore.exe
185.88.181.4:80
www.xvideos.com
ServerStack, Inc.
NL
suspicious
3380
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1012
iexplore.exe
152.195.133.76:80
static-egc.xvideos-cdn.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1012
iexplore.exe
8.253.207.243:80
img-l3.xvideos-cdn.com
Level 3 Communications, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.xvideos.com
  • 185.88.181.4
  • 185.88.181.5
  • 185.88.181.6
  • 185.88.181.7
  • 185.88.181.8
  • 185.88.181.9
  • 185.88.181.10
  • 185.88.181.11
  • 185.88.181.2
  • 185.88.181.3
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
static-egc.xvideos-cdn.com
  • 152.195.133.76
suspicious
img-l3.xvideos-cdn.com
  • 8.253.207.243
  • 8.252.23.243
  • 8.253.221.243
  • 8.252.23.115
whitelisted

Threats

PID
Process
Class
Message
1012
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
file.exe