File name: | talk-it.exe |
Full analysis: | https://app.any.run/tasks/d76c74a9-e482-428b-a1fc-595d473d8d79 |
Verdict: | Malicious activity |
Analysis date: | April 30, 2024, 15:30:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, made by v2.0, extract using at least v2.0, last modified Tue Jul 2 10:32:59 1991, uncompressed size 324608, method=deflate |
MD5: | FDC726071430ADA68E117F6F12F01322 |
SHA1: | 2DAA8755F47713B00C1DBEFE7D9C8E4C5690518B |
SHA256: | 2BFC1657C918035FAB5FA2DA8E4E76D54CF9B65AC1E65DCDEDE65CC19A6771F6 |
SSDEEP: | 6144:TMM8fApOSxvbaiwb7AyT21XOHxXAsEbzd/CAuQ0ykuyoJlbOSvT+Pn1IB:N8f8vbad7Aya0R47uZuxJ7vT+/C |
.exe | | | Win32 Executable MS Visual C++ 4.x (57.6) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (13.3) |
.exe | | | Win64 Executable (generic) (11.8) |
.exe | | | Winzip Win32 self-extracting archive (generic) (9.8) |
.dll | | | Win32 Dynamic Link Library (generic) (2.8) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 1999:04:26 17:51:13+00:00 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
PEType: | PE32 |
LinkerVersion: | 4.2 |
CodeSize: | 17408 |
InitializedDataSize: | 13312 |
UninitializedDataSize: | - |
EntryPoint: | 0x35ee |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1292 | "C:\Temp\Ogif\TalkAny\TalkAny.exe" | C:\Temp\Ogif\TalkAny\TalkAny.exe | — | talk-it.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Talk It! MFC Application Version: 1.0.0.1106 Modules
| |||||||||||||||
2024 | "C:\Users\admin\Desktop\talk-it.exe" | C:\Users\admin\Desktop\talk-it.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
3968 | "C:\Users\admin\Desktop\talk-it.exe" | C:\Users\admin\Desktop\talk-it.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
4036 | "C:\Temp\Ogif\TalkAny\TalkAny.exe" | C:\Temp\Ogif\TalkAny\TalkAny.exe | — | talk-it.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Talk It! MFC Application Exit code: 3221225547 Version: 1.0.0.1106 Modules
|
(PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tieng32.dll | executable | |
MD5:63EBDCC2EA86671601AF678535AAAF9D | SHA256:4E261DCDF4ECA118CF75C39B2F52D5B00888DE820DF9E4E868183A039F25E98B | |||
3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tispan32.dll | executable | |
MD5:1E522006E572619DABE8713EBC83C27F | SHA256:CCC3C0B35B42EF40E116A8BA5E6F40C1F303E00F6D6C31C9A9EAC5994B1D5294 | |||
3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tibase32.dll | executable | |
MD5:2CB4F99812841F5271EA9FCE41DDDB46 | SHA256:9297F69236B296238096BAA1E9D00567FC74409B5A7EBE2565DA71B27FCDC5CB | |||
3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\TalkAny.exe | executable | |
MD5:BBC3687E84989E3F70F2179BA9A458B3 | SHA256:49534E847F24FDD727ADA248666C5EBBBF7CEFFF54443DF1DD56240CCCB50A97 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |