| File name: | talk-it.exe |
| Full analysis: | https://app.any.run/tasks/d76c74a9-e482-428b-a1fc-595d473d8d79 |
| Verdict: | Malicious activity |
| Analysis date: | April 30, 2024, 15:30:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, made by v2.0, extract using at least v2.0, last modified Tue Jul 2 10:32:59 1991, uncompressed size 324608, method=deflate |
| MD5: | FDC726071430ADA68E117F6F12F01322 |
| SHA1: | 2DAA8755F47713B00C1DBEFE7D9C8E4C5690518B |
| SHA256: | 2BFC1657C918035FAB5FA2DA8E4E76D54CF9B65AC1E65DCDEDE65CC19A6771F6 |
| SSDEEP: | 6144:TMM8fApOSxvbaiwb7AyT21XOHxXAsEbzd/CAuQ0ykuyoJlbOSvT+Pn1IB:N8f8vbad7Aya0R47uZuxJ7vT+/C |
MALICIOUS
Drops the executable file immediately after the start
- talk-it.exe (PID: 3968)
SUSPICIOUS
Reads the Internet Settings
- talk-it.exe (PID: 3968)
- talk-it.exe (PID: 2024)
Reads security settings of Internet Explorer
- talk-it.exe (PID: 3968)
- talk-it.exe (PID: 2024)
Executable content was dropped or overwritten
- talk-it.exe (PID: 3968)
Starts a Microsoft application from unusual location
- TalkAny.exe (PID: 4036)
- TalkAny.exe (PID: 1292)
Process drops legitimate windows executable
- talk-it.exe (PID: 3968)
INFO
Checks supported languages
- talk-it.exe (PID: 3968)
- TalkAny.exe (PID: 4036)
- talk-it.exe (PID: 2024)
- TalkAny.exe (PID: 1292)
Reads the computer name
- TalkAny.exe (PID: 4036)
- talk-it.exe (PID: 3968)
- talk-it.exe (PID: 2024)
- TalkAny.exe (PID: 1292)
Manual execution by a user
- talk-it.exe (PID: 2024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ 4.x (57.6) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (13.3) |
| .exe | | | Win64 Executable (generic) (11.8) |
| .exe | | | Winzip Win32 self-extracting archive (generic) (9.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (2.8) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1999:04:26 17:51:13+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 4.2 |
| CodeSize: | 17408 |
| InitializedDataSize: | 13312 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x35ee |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
37
Monitored processes
4
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1292 | "C:\Temp\Ogif\TalkAny\TalkAny.exe" | C:\Temp\Ogif\TalkAny\TalkAny.exe | — | talk-it.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Talk It! MFC Application Version: 1.0.0.1106 Modules
| |||||||||||||||
| 2024 | "C:\Users\admin\Desktop\talk-it.exe" | C:\Users\admin\Desktop\talk-it.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3968 | "C:\Users\admin\Desktop\talk-it.exe" | C:\Users\admin\Desktop\talk-it.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 4036 | "C:\Temp\Ogif\TalkAny\TalkAny.exe" | C:\Temp\Ogif\TalkAny\TalkAny.exe | — | talk-it.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Talk It! MFC Application Exit code: 3221225547 Version: 1.0.0.1106 Modules
| |||||||||||||||
Total events
1 125
Read events
1 109
Write events
16
Delete events
0
Modification events
| (PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3968) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2024) talk-it.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\TalkAny.exe | executable | |
MD5:BBC3687E84989E3F70F2179BA9A458B3 | SHA256:49534E847F24FDD727ADA248666C5EBBBF7CEFFF54443DF1DD56240CCCB50A97 | |||
| 3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tieng32.dll | executable | |
MD5:63EBDCC2EA86671601AF678535AAAF9D | SHA256:4E261DCDF4ECA118CF75C39B2F52D5B00888DE820DF9E4E868183A039F25E98B | |||
| 3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tibase32.dll | executable | |
MD5:2CB4F99812841F5271EA9FCE41DDDB46 | SHA256:9297F69236B296238096BAA1E9D00567FC74409B5A7EBE2565DA71B27FCDC5CB | |||
| 3968 | talk-it.exe | C:\Temp\Ogif\TalkAny\Tispan32.dll | executable | |
MD5:1E522006E572619DABE8713EBC83C27F | SHA256:CCC3C0B35B42EF40E116A8BA5E6F40C1F303E00F6D6C31C9A9EAC5994B1D5294 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |