File name: | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000c |
Full analysis: | https://app.any.run/tasks/601a4882-d4fe-4c42-ba24-6cfc96d632b0 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 03:42:07 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | F14153BBD95FC26D9CCEA77C49CF09B9 |
SHA1: | CB59F900711EA751C4322B4DAB50FA2C0EE70B33 |
SHA256: | 27EAB496D0B63D52C18CEE063110D9D479523B58426BFCB58E420A5CAE087C54 |
SSDEEP: | 12288:aBVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzho:SU7ecSgL6y+gk+rnxdarFu |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2093-Aug-30 18:10:57 |
Debug artifacts: |
|
Comments: | - |
CompanyName: | - |
FileDescription: | krnl_bootstrapper |
FileVersion: | 1.0.0.0 |
InternalName: | krnl_bootstrapper.exe |
LegalCopyright: | Copyright © 2022 |
LegalTrademarks: | - |
OriginalFilename: | krnl_bootstrapper.exe |
ProductName: | krnl_bootstrapper |
ProductVersion: | 1.0.0.0 |
Assembly Version: | 1.0.0.0 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 3 |
TimeDateStamp: | 2093-Aug-30 18:10:57 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 8192 | 939412 | 939520 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.5376 |
.rsrc | 950272 | 256216 | 256512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.20735 |
.reloc | 1212416 | 12 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.10191 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 1.16474 | 254536 | UNKNOWN | UNKNOWN | RT_ICON |
32512 | 2.01924 | 20 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
1 (#2) | 3.26862 | 860 | UNKNOWN | UNKNOWN | RT_VERSION |
1 (#3) | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
mscoree.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3052 | "C:\Users\admin\Desktop\f_00000c.exe" | C:\Users\admin\Desktop\f_00000c.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Description: krnl_bootstrapper Exit code: 4294967295 Version: 1.0.0.0 | ||||
3804 | "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch; | C:\Windows\SYSTEM32\WISPTIS.EXE | — | f_00000c.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Pen and Touch Input Component Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3688 | "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch; | C:\Windows\SYSTEM32\WISPTIS.EXE | f_00000c.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Pen and Touch Input Component Exit code: 24 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3720 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) | ||||
1176 | "C:\Users\admin\Desktop\krnl\7za.exe" x "C:\Users\admin\Desktop\krnl\bin\src.7z" -o"C:\Users\admin\Desktop\krnl\bin" -aoa -bsp1 | C:\Users\admin\Desktop\krnl\7za.exe | — | f_00000c.exe |
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7-Zip Standalone Console Exit code: 0 Version: 15.14 | ||||
3792 | "C:\Users\admin\Desktop\krnl\7za.exe" x "C:\Users\admin\Desktop\krnl\bin\Monaco.zip" -o"C:\Users\admin\Desktop\krnl\bin" -aoa -bsp1 | C:\Users\admin\Desktop\krnl\7za.exe | — | f_00000c.exe |
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7-Zip Standalone Console Exit code: 0 Version: 15.14 | ||||
3676 | "C:\Users\admin\Desktop\krnl\krnlss.exe" | C:\Users\admin\Desktop\krnl\krnlss.exe | f_00000c.exe | |
User: admin Integrity Level: MEDIUM Description: Exit code: 3762504530 Version: 0.0.0.0 | ||||
2828 | C:\Windows\system32\WerFault.exe -u -p 3676 -s 1696 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1308 | "C:\Users\admin\Desktop\krnl\krnlss.exe" | C:\Users\admin\Desktop\krnl\krnlss.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Description: Exit code: 3762504530 Version: 0.0.0.0 | ||||
1144 | C:\Windows\system32\WerFault.exe -u -p 1308 -s 1600 | C:\Windows\system32\WerFault.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3052 | f_00000c.exe | C:\Users\admin\Desktop\krnl\bin\src.7z | — | |
MD5:— | SHA256:— | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.BrowserSubprocess.Core.pdb | — | |
MD5:— | SHA256:— | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.Core.pdb | — | |
MD5:— | SHA256:— | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.xml | xml | |
MD5:9D1F460B86B696312AE92226041DF8E4 | SHA256:3AADA0CDA50987E08C904283D7DA20150C685116F387EF370C60B9105ED4F871 | |||
3052 | f_00000c.exe | C:\Users\admin\Desktop\krnl\krnlss.exe.config | xml | |
MD5:0ED4B3831FF5E91DFF636145F68AAC4C | SHA256:03962AE5A55DFC70E2717771A9A7AA37B956B2C5B4C62E3CFF9FE24360250347 | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.BrowserSubprocess.exe.config | xml | |
MD5:442320A07B9078E437FAFF02ABDBF6D6 | SHA256:849CD2EFCAF7521B7BA75F98A43AB567208A5B7B8CE7623679C6F404DD976D09 | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.Wpf.pdb | pdb | |
MD5:700051139E5D30A0341EAFE2348F3D54 | SHA256:3DF8AC55B6C8F8E8542740BAE27B2B2178DDCC93619C5DDE71A791B42755BF93 | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.Core.xml | xml | |
MD5:B9ACD73501B72D46543855937F32F0CF | SHA256:C6637029C43CDA887473532E9F059D13E4D7FAADEBB4B8D9150F8E2D59343DB6 | |||
3052 | f_00000c.exe | C:\Users\admin\Desktop\krnl\7za.exe | executable | |
MD5:EC79CABD55A14379E4D676BB17D9E3DF | SHA256:44A55F5D9C31D0990DE47B9893E0C927478930CEF06FBE2D1F520A6D6CBA587D | |||
1176 | 7za.exe | C:\Users\admin\Desktop\krnl\bin\src\CefSharp.BrowserSubprocess.pdb | pdb | |
MD5:8500C8EAEDF45493B8469F25C71E4A1E | SHA256:C4EE78C4DBCCF4A1A1E389BC0702F4EC9E1FAE92A2710CCA0D28C18BE2D93A62 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3052 | f_00000c.exe | 188.114.96.3:443 | k-storage.com | CLOUDFLARENET | NL | malicious |
3052 | f_00000c.exe | 51.178.133.139:443 | cdn.krnl.place | OVH SAS | FR | unknown |
Domain | IP | Reputation |
---|---|---|
cdn.krnl.place |
| suspicious |
k-storage.com |
| malicious |
dns.msftncsi.com |
| shared |