| File name: | bomb.exe |
| Full analysis: | https://app.any.run/tasks/138269c6-93a1-4e97-a4e6-5a7d347051da |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | June 12, 2024, 21:40:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 55DBA6E7AA4E8CC73415F4E3F9F6BDAE |
| SHA1: | 87C9F29D58F57A5E025061D389BE2655EE879D5D |
| SHA256: | 3CEA805F1396DF15BDBCD4317388A046A41A6079DBA04576A58BA7B2C812338A |
| SSDEEP: | 192:HLmmmmlmtYz0wZick7pDMj4GbCrMz+MCZLa7HhdSbwxz1OLU87glpp/bI6J4yfm4:pmi7k7pMiLLaLhM6OLU870NJqoI |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2048:07:19 19:03:26+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 9728 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x457a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | - |
| FileVersion: | 1.0.0.0 |
| InternalName: | bomb.exe |
| LegalCopyright: | - |
| LegalTrademarks: | - |
| OriginalFileName: | bomb.exe |
| ProductName: | - |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 124 | powershell start-process -WindowStyle Hidden gpupdate.exe /force | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 188 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6757f598,0x6757f5a8,0x6757f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 188 | "C:\Windows\system32\gpupdate.exe" /force | C:\Windows\System32\gpupdate.exe | — | powershell.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Group Policy Update Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 312 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1364,i,17794756257549945566,9380491087224570004,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 336 | "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account | C:\Program Files\Google\Chrome\Application\chrome.exe | — | d34aaa08b3.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 336 | .\Install.exe | C:\Users\admin\AppData\Local\Temp\7zSCDBD.tmp\Install.exe | setup.exe | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Version: 9.20 Modules
| |||||||||||||||
| 588 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1236 --field-trial-handle=1356,i,17765420270117311795,8299430817354531747,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 588 | "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MUpKdfMcUwjMjiKs" /t REG_DWORD /d 0 | C:\Windows\System32\reg.exe | — | wscript.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 616 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\System32\ntvdm.exe | — | bomb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 660 | C:\Users\admin\sysmablsvr.exe | C:\Users\admin\sysmablsvr.exe | http185.215.113.66newtpp.exe.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (3956) bomb.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 748 | http185.215.113.66newtpp.exe.exe | C:\Users\admin\sysmablsvr.exe | executable | |
MD5:4505DAF4C08FC8E8E1380911E98588AA | SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40 | |||
| 3956 | bomb.exe | C:\Users\admin\Desktop\http185.215.113.66pei.exe.exe | executable | |
MD5:8D8E6C7952A9DC7C0C73911C4DBC5518 | SHA256:FEB4C3AE4566F0ACBB9E0F55417B61FEFD89DC50A4E684DF780813FB01D61278 | |||
| 3956 | bomb.exe | C:\Users\admin\Desktop\http185.215.113.66newtpp.exe.exe | executable | |
MD5:4505DAF4C08FC8E8E1380911E98588AA | SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40 | |||
| 820 | http185.215.113.66pei.exe.exe | C:\Users\admin\AppData\Local\Temp\2320213981.exe | executable | |
MD5:4505DAF4C08FC8E8E1380911E98588AA | SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40 | |||
| 616 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs78DC.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
| 616 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs78CC.tmp | text | |
MD5:8CF6DDB5AA59B49F34B967CD46F013B6 | SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C | |||
| 820 | http185.215.113.66pei.exe.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\newtpp[1].exe | executable | |
MD5:4505DAF4C08FC8E8E1380911E98588AA | SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40 | |||
| 1960 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scsA2EA.tmp | text | |
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B | SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD | |||
| 2680 | httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exe | C:\Users\admin\AppData\Local\Temp\putrefactible | binary | |
MD5:C3F40D425D3A0CA4B4B41B6CAAA0D718 | SHA256:EF7C97B98F5B48FB212A0644860F18DB870283D0E81A99AF7103FE40F8B111D9 | |||
| 2680 | httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exe | C:\Users\admin\AppData\Local\Temp\autB44E.tmp | binary | |
MD5:C3F40D425D3A0CA4B4B41B6CAAA0D718 | SHA256:EF7C97B98F5B48FB212A0644860F18DB870283D0E81A99AF7103FE40F8B111D9 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3956 | bomb.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/pei.exe | unknown | — | — | unknown |
3956 | bomb.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/newtpp.exe | unknown | — | — | unknown |
820 | http185.215.113.66pei.exe.exe | GET | 200 | 185.215.113.66:80 | http://twizt.net/newtpp.exe | unknown | — | — | unknown |
820 | http185.215.113.66pei.exe.exe | GET | 200 | 185.215.113.66:80 | http://twizt.net/peinstall.php | unknown | — | — | unknown |
660 | sysmablsvr.exe | GET | — | 185.215.113.66:80 | http://185.215.113.66/2 | unknown | — | — | unknown |
660 | sysmablsvr.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/1 | unknown | — | — | unknown |
660 | sysmablsvr.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/2 | unknown | — | — | unknown |
3956 | bomb.exe | GET | 200 | 147.45.47.81:80 | http://147.45.47.81/xmrig.exe | unknown | — | — | unknown |
3956 | bomb.exe | GET | 200 | 77.91.77.81:80 | http://77.91.77.81/lend/theporndude.exe | unknown | — | — | unknown |
3956 | bomb.exe | GET | 200 | 147.45.47.81:80 | http://147.45.47.81/WatchDog.exe | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3956 | bomb.exe | 151.101.130.49:443 | urlhaus.abuse.ch | FASTLY | US | unknown |
3956 | bomb.exe | 185.215.113.66:80 | twizt.net | 1337team Limited | SC | unknown |
3956 | bomb.exe | 103.233.255.176:443 | cnasjqw.cn | High Family Technology Co., Limited | SG | unknown |
3956 | bomb.exe | 188.114.97.3:443 | uploaddeimagens.com.br | CLOUDFLARENET | NL | unknown |
820 | http185.215.113.66pei.exe.exe | 185.215.113.66:80 | twizt.net | 1337team Limited | SC | unknown |
660 | sysmablsvr.exe | 185.215.113.66:80 | twizt.net | 1337team Limited | SC | unknown |
Domain | IP | Reputation |
|---|---|---|
urlhaus.abuse.ch |
| whitelisted |
cnasjqw.cn |
| unknown |
asnwekow.com |
| unknown |
www.asjdnwe.cn |
| unknown |
www.adjefjeo.com |
| unknown |
asdqmdo.cn |
| unknown |
bndaeq.com |
| unknown |
www.asjqqe.com |
| unknown |
nbvand.cn |
| unknown |
www.cajasnq.cn |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
3956 | bomb.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 34 |
3956 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
3956 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
3956 | bomb.exe | Potentially Bad Traffic | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile |
3956 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
3956 | bomb.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3956 | bomb.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
820 | http185.215.113.66pei.exe.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
1088 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
3956 | bomb.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
Process | Message |
|---|---|
http77.91.77.80romekenzo.exe.exe | ret 345 fdhg r |
http77.91.77.80romekenzo.exe.exe | er er y try rtsdh |
http77.91.77.80romekenzo.exe.exe | tr 656 56 65 8658 658hfty |
http77.91.77.80romekenzo.exe.exe | g 56 58y6 |
j3BulqBW6IWYjU8Jp5_e.exe | ret 345 fdhg r |
http77.91.77.80romekenzo.exe.exe | h6rt hrd54 |
6AyaE0gmxvQm8WQqeKRC.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
explortu.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
j3BulqBW6IWYjU8Jp5_e.exe | tr 656 56 65 8658 658hfty |
j3BulqBW6IWYjU8Jp5_e.exe | er er y try rtsdh |