File name: | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe |
Full analysis: | https://app.any.run/tasks/6d74225b-8e02-4a6c-9545-b907ccbf28e2 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 21:10:57 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections |
MD5: | 6B7DC1B91B2EEFA7A408902219B64A2F |
SHA1: | 1B06A3413BBBCF1DA029375840806D05AEF8BFDF |
SHA256: | 273A61EB82104B8252E1328BD9650CFBC2FDD47031D856D993EB96CE958D6D63 |
SSDEEP: | 3072:cpDSvVVVVVVVVwSQcxpDSvVVVVVVVVwSQc2:cdSvVVVVVVVVwStdSvVVVVVVVVwSS |
.exe | | | Win32 Executable MS Visual C++ (generic) (30.9) |
---|---|---|
.exe | | | Win64 Executable (generic) (27.3) |
.exe | | | UPX compressed Win32 Executable (26.8) |
.dll | | | Win32 Dynamic Link Library (generic) (6.5) |
.exe | | | Win32 Executable (generic) (4.4) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2011:03:15 04:06:07+00:00 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 8192 |
InitializedDataSize: | 4096 |
UninitializedDataSize: | 24576 |
EntryPoint: | 0x2130 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5308 | "C:\Users\admin\Desktop\273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe" | C:\Users\admin\Desktop\273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | — | ||
MD5:— | SHA256:— | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak.tmp | executable | |
MD5:51B0BAB098B1B6E1D10FB1E1AC643CCF | SHA256:696762079697295D7E34F498D950E961B0AF5956F133B9F68B81A2526CF526B1 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmp | executable | |
MD5:09C2B3E896D52BADFF0FCC37114BF879 | SHA256:EE82E4B04F78E75B0A0333CC35F664E1B61C0E74C0E539C900A9D87D1DF690D0 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmp | executable | |
MD5:290CB991699FF379D537CB76CF32CE86 | SHA256:97481AF5B397E1AD45D9CFDCDED5E27D1EE974C0E9BBF0995081AD098730F3CB | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmp | executable | |
MD5:7BE9ECBD36D89BD0BD2512ABCCF13705 | SHA256:8CC1528DE487390EA45C60F8EBC5EDF5899FBB691C13B7E41E97237C78B9843F | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmp | executable | |
MD5:68DD9D685B4F97B9C9FC16AB8C44C732 | SHA256:3D76B246E095F3E470A0EE1B5C3D94BEFF3202B97D4DA45ADEBF82E3F00EEA55 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exe | executable | |
MD5:B02C947B77A03040E0DCBD668746161A | SHA256:CDAC8D5EE0BD47B35CD93383F53452234026C4D08AA6B8BC88AC795C7CDE4E7A | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak.tmp | executable | |
MD5:642AB1E81341F373EB87870CEA0C568B | SHA256:850A45F28E912643CADEC2AF23635EC49705816E9BBE2D9295ED90F9B0B6C8B0 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatRes.dll.tmp | executable | |
MD5:7C7B539D858F2704BBF4F7233027C887 | SHA256:C3F2E766D7A68D9D2D6920BD32D96EC4B6FC21F012E0F1F1462A7C1C9F868454 | |||
5308 | 273a61eb82104b8252e1328bd9650cfbc2fdd47031d856d993eb96ce958d6d63.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe.tmp | executable | |
MD5:F66E45D48DCA9CE922D653975CB31013 | SHA256:A1029DFC5631E528CCFE5AFC395481E44C95A02E0273938A9F592DB022954EB9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4536 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4536 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4536 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4536 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4536 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |