analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| download: | sync |
| Full analysis: | https://app.any.run/tasks/023d6cdf-f3b6-470b-a2ae-dda07448106c |
| Verdict: | Malicious activity |
| Analysis date: | December 05, 2019, 16:17:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/octet-stream |
| File info: | very short file (no magic) |
| MD5: | 7215EE9C7D9DC229D2921A40E899EC5F |
| SHA1: | B858CB282617FB0956D960215C8E84D1CCF909C6 |
| SHA256: | 36A9E7F1C95B82FFB99743E0C5C4CE95D83C9A430AAC59F84EF3CBFAB6145068 |
| SSDEEP: | 3:F:F |
MALICIOUS
Loads the Task Scheduler COM API
- CCleaner.exe (PID: 3432)
- CCleaner.exe (PID: 1796)
Changes the autorun value in the registry
- CCleaner.exe (PID: 1796)
Actions looks like stealing of personal data
- CCleaner.exe (PID: 1796)
- CCleaner.exe (PID: 3784)
SUSPICIOUS
Reads internet explorer settings
- CCleaner.exe (PID: 3784)
- CCleaner.exe (PID: 1796)
Executed via Task Scheduler
- CCleaner.exe (PID: 3784)
Reads Internet Cache Settings
- CCleaner.exe (PID: 3784)
Reads the cookies of Mozilla Firefox
- CCleaner.exe (PID: 3784)
Creates files in the user directory
- CCleaner.exe (PID: 3784)
Application launched itself
- CCleaner.exe (PID: 3784)
Removes files from Windows directory
- CCleaner.exe (PID: 3784)
Reads the cookies of Google Chrome
- CCleaner.exe (PID: 3784)
Low-level read access rights to disk partition
- CCleaner.exe (PID: 3784)
INFO
Manual execution by user
- CCleaner.exe (PID: 3432)
Reads settings of System Certificates
- CCleaner.exe (PID: 3784)
Reads Microsoft Office registry keys
- CCleaner.exe (PID: 3784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
40
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2492 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\sync | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2300 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\sync | C:\Windows\system32\NOTEPAD.EXE | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3432 | "C:\Program Files\CCleaner\CCleaner.exe" | C:\Program Files\CCleaner\CCleaner.exe | — | explorer.exe |
User: admin Company: Piriform Ltd Integrity Level: MEDIUM Description: CCleaner Exit code: 0 Version: 5, 35, 0, 6210 | ||||
| 3784 | "C:\Program Files\CCleaner\CCleaner.exe" /uac | C:\Program Files\CCleaner\CCleaner.exe | taskeng.exe | |
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Exit code: 0 Version: 5, 35, 0, 6210 | ||||
| 1796 | "C:\Program Files\CCleaner\CCleaner.exe" /monitor | C:\Program Files\CCleaner\CCleaner.exe | CCleaner.exe | |
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Version: 5, 35, 0, 6210 | ||||
Total events
1 468
Read events
1 103
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
30
Text files
0
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-shm | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YNKXL5C93ND298I47W3U.temp | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TD3GP6V2JG224SPBUZRO.temp | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JJVSO80N7JHJRNNCJUK2.temp | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019120520191206\index.dat | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\7e4dca80246863e3.automaticDestinations-ms | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9839aec31243a928.automaticDestinations-ms | — | |
MD5:— | SHA256:— | |||
| 3784 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\9c7cc110ff56d1bd.automaticDestinations-ms | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
2
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3784 | CCleaner.exe | GET | 301 | 151.101.0.64:80 | http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-VJCA&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127 | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3784 | CCleaner.exe | 151.101.2.202:443 | www.ccleaner.com | Fastly | US | suspicious |
3784 | CCleaner.exe | 151.101.0.64:443 | www.piriform.com | Fastly | US | whitelisted |
3784 | CCleaner.exe | 151.101.0.64:80 | www.piriform.com | Fastly | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.piriform.com |
| whitelisted |
www.ccleaner.com |
| whitelisted |