Malware analysis http://oufgaeougf9aegf9age9fga.su/o.exe Malicious activity

Add for printing

URL:	http://oufgaeougf9aegf9age9fga.su/o.exe
Full analysis:	https://app.any.run/tasks/df6bab08-2a27-45ac-878b-84cf66d2a6db
Verdict:	Malicious activity
Threats:	Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	July 18, 2019, 13:56:19
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan
Indicators:
MD5:	E3ABFFE8A6A377B1AE4137DF5C2B90D5
SHA1:	E44C8458311638EAEAB48EF1A6B58A0C6D958EAA
SHA256:	3D78772ECF4FE9CB79C09F03AA4B23ECA175AC6C2FDF8E8DB440E553E6852A58
SSDEEP:	3:N1KRQMu11QKw:C2Mm1QKw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (75.0.3770.100)
Google Update Helper (1.3.34.7)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.7.2 (4.7.03062)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB4019990
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 3736)
- Reads internet explorer settings
  - iexplore.exe (PID: 3644)
- Creates files in the user directory
  - iexplore.exe (PID: 3736)
  - iexplore.exe (PID: 3644)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3644)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Parent process
3736	"C:\Program Files\Internet Explorer\iexplore.exe" "http://oufgaeougf9aegf9age9fga.su/o.exe"	C:\Program Files\Internet Explorer\iexplore.exe	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3644	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3736 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

361

Read events

316

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\o[1].exe		—
		MD5:—	SHA256:—
3736	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\favicon[1].ico		—
		MD5:—	SHA256:—
3736	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat		dat
		MD5:A89F00DDE8CA1F9B61B02A7B6D44B752	SHA256:56761B0251C3799466C8B64C1BA27137145DD8556C1A03FBF6A2811FABED34D7
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT		smt
		MD5:654B491B0D82FCB5CAE9DCF66DA08D84	SHA256:A3C16D2548909FF5AA67CBB4D6BE264BDCD1EB268DB6C0BE446C4DC6B03ED43C
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIMVM10U\font-awesome[1].css		text
		MD5:C8E08CAAF01D25764BAA1CF93DE6070F	SHA256:F5B3A05927C9D91518E88D2E12024082BBCFA6A81FC114750D57C98CAAE6DF1A
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIMVM10U\default[1].css		text
		MD5:6093C5B61B4FBB1AE54748816FB4D556	SHA256:54355812D3B0C18A23F4FCF198DFAF0D97570EFDB9925E93F1ABC86C8D5D9F5F
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\o[1].htm		html
		MD5:633B9AA049162E35413589D74A955D24	SHA256:A071923F3B62B5EB70028FCAE0352745036B32B5E161D4D773E32B8CF106E5D5
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8BW8CI0Y\index-products3[1].png		image
		MD5:6A198F526690667C6740EC4C661C0884	SHA256:DB5121B72995BF55F87746AFD564EDE33865330AC4CE5EF54D4578B3CE81C78B
3644	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PUF80D1U\park-bg_m[1].jpg		image
		MD5:C4E81C2EDD8A86B77540F34DC704C407	SHA256:1B193B4C60E277F402ACEE953C9097645569EB3A7A3B71F860876A5316CA4611

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3644	iexplore.exe	GET	—	104.25.28.16:80	http://park.101datacenter.net/css/font-awesome/fontawesome-webfont.eot?	US	—	—	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/js/enhancements.js?20190709035841	US	text	299 b	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/images/vendor-1/index-products4.png?20190709035841	US	image	11.1 Kb	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/css/vendor-1.css?20190709035841	US	text	2.21 Kb	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/css/font-awesome/font-awesome.css	US	text	2.33 Kb	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/css/default.css	US	text	5.08 Kb	whitelisted
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/images/vendor-1/index-products3.png?20190709035841	US	image	18.4 Kb	whitelisted
3644	iexplore.exe	GET	200	199.73.55.48:80	http://oufgaeougf9aegf9age9fga.su/o.exe	US	html	1.47 Kb	malicious
3644	iexplore.exe	GET	200	104.25.28.16:80	http://park.101datacenter.net/images/vendor-1/park-bg_m.jpg?20190709035841	US	image	27.2 Kb	whitelisted
3644	iexplore.exe	GET	404	104.25.28.16:80	http://park.101datacenter.net/css/fonts/LatoRegular.eot)%20format(%22embedded-opentype%22),%20url(fonts/LatoRegular.woff2)%20format(%22woff2%22),%20url(fonts/LatoRegular.woff)%20format(%22woff%22),%20url(fonts/LatoRegular.ttf)%20format(%22truetype%22),%20url(fonts/LatoRegular.svg	US	html	187 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3736	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3644	iexplore.exe	199.73.55.48:80	oufgaeougf9aegf9age9fga.su	ScaleMatrix	US	malicious
3736	iexplore.exe	13.107.21.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3644	iexplore.exe	35.175.40.164:443	cs-cdn.deviceatlas.com	Amazon.com, Inc.	US	unknown
3644	iexplore.exe	104.25.28.16:80	park.101datacenter.net	Cloudflare Inc	US	shared

DNS requests

Domain	IP	Reputation
oufgaeougf9aegf9age9fga.su	199.73.55.48	malicious
www.bing.com	13.107.21.200 204.79.197.200	whitelisted
park.101datacenter.net	104.25.28.16 104.25.29.16	whitelisted
cs-cdn.deviceatlas.com	35.175.40.164	unknown

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET DNS Query for .su TLD (Soviet Union) Often Malware Related
3644	iexplore.exe	A Network Trojan was detected	ET TROJAN Single char EXE direct download likely trojan (multiple families)
3644	iexplore.exe	Potentially Bad Traffic	ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3644	iexplore.exe	Potentially Bad Traffic	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile

Add for printing

No debug info

General Info

http://oufgaeougf9aegf9age9fga.su/o.exe

E3ABFFE8A6A377B1AE4137DF5C2B90D5

E44C8458311638EAEAB48EF1A6B58A0C6D958EAA

3D78772ECF4FE9CB79C09F03AA4B23ECA175AC6C2FDF8E8DB440E553E6852A58

3:N1KRQMu11QKw:C2Mm1QKw

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Changes internet zones settings

Reads internet explorer settings

Creates files in the user directory

Reads Internet Cache Settings

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings