| File name: | SuperCarver V1.3.0.exe |
| Full analysis: | https://app.any.run/tasks/0123a002-ed04-4346-8a24-dfc0f921b947 |
| Verdict: | Malicious activity |
| Analysis date: | December 07, 2023, 15:23:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 3D067467BAEAD6A92088520811585B2D |
| SHA1: | 8EF7CD508921F9519502EDC91D052C223A96C02A |
| SHA256: | 42A27FCE21DF9B8B83FC0276BBA1D8C95FC855F23582AD5C80F34B7E45EFA461 |
| SSDEEP: | 49152:GYzBYUkpv7CO1XoCiVQUjaW7OFkRh8v7bAXhM3C71IWFu71RdR5AfyQi+1XUYaXf:zGUS/tv4QUjaW7rn8TbAXhM3C7uWYJBL |
| .exe | | | UPX compressed Win32 Executable (39.3) |
|---|---|---|
| .exe | | | Win32 EXE Yoda's Crypter (38.6) |
| .dll | | | Win32 Dynamic Link Library (generic) (9.5) |
| .exe | | | Win32 Executable (generic) (6.5) |
| .exe | | | Generic Win/DOS Executable (2.9) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:05:21 18:01:00+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 929792 |
| InitializedDataSize: | 73728 |
| UninitializedDataSize: | 1175552 |
| EntryPoint: | 0x201690 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.3.0.0 |
| ProductVersionNumber: | 1.3.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Chinese (Simplified) |
| CharacterSet: | Unicode |
| FileVersion: | 1.3.0.0 |
| FileDescription: | SuperCarver |
| ProductName: | SuperCarver |
| ProductVersion: | 1.3.0.0 |
| LegalCopyright: | 作者版权所有 请尊重并使用正版 |
| Comments: | 本程序使用易语言编写(http://www.eyuyan.com) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | "C:\Users\admin\Desktop\SuperCarver V1.3.0.exe" | C:\Users\admin\Desktop\SuperCarver V1.3.0.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: SuperCarver Exit code: 0 Version: 1.3.0.0 Modules
| |||||||||||||||
| 316 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3768 --field-trial-handle=1296,i,1422285504317629191,2930567110706821936,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 528 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1296,i,1422285504317629191,2930567110706821936,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 788 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2228 --field-trial-handle=1336,i,5755361337854109639,16717021193303782782,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 844 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1336,i,5755361337854109639,16717021193303782782,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1344 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1552 --field-trial-handle=1336,i,5755361337854109639,16717021193303782782,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1508 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3852 --field-trial-handle=1296,i,1422285504317629191,2930567110706821936,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1528 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3772 --field-trial-handle=1336,i,5755361337854109639,16717021193303782782,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2260 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bainuoxing.com/en/ | C:\Program Files\Microsoft\Edge\Application\msedge.exe | SuperCarver V1.3.0.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2504 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1336,i,5755361337854109639,16717021193303782782,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| (PID) Process: | (2528) Driver.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2528) Driver.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2528) Driver.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2528) Driver.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (4060) Driver.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR SFX |
| Operation: | write | Name: | C%%WCH.CN%CH341SER |
Value: C:\WCH.CN\CH341SER | |||
| (PID) Process: | (4036) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (4036) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (4036) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (4036) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (4036) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4036 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF2173e7.TMP | — | |
MD5:— | SHA256:— | |||
| 4036 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 280 | SuperCarver V1.3.0.exe | C:\SuperCarver\Driver.exe | executable | |
MD5:EAF51C4DE2C5392803505C8791458913 | SHA256:625841A5F3D2ECEBA4B0193124F31514FF706CD7B9919239B86161E6A298A945 | |||
| 2528 | Driver.exe | C:\WCH.CN\CH341SER\ch341SER.CAT | cat | |
MD5:715693624013826D337E792ED86376AC | SHA256:585FCA8AB9C8A13222760D6BBAB62CE4069D24F73BD304D89C54B5298B9420BD | |||
| 2528 | Driver.exe | C:\WCH.CN\CH341SER\SETUP.EXE | executable | |
MD5:7D50A57D7DD8B644C777F600094C80A9 | SHA256:0E761F891F77F5953F24B9F4E5CBFBD9CD441D42ED6364B371A80D887DC3AC61 | |||
| 4036 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF2173f7.TMP | — | |
MD5:— | SHA256:— | |||
| 4036 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2528 | Driver.exe | C:\WCH.CN\CH341SER\CH341S98.SYS | executable | |
MD5:B6F4A83911336E84BEAD8F8905285FAB | SHA256:0ECD1222627271EA31D3B64796992B6DAF5133D64CC26D43B3873CBE32FD59CB | |||
| 2528 | Driver.exe | C:\WCH.CN\CH341SER\CH341S64.SYS | executable | |
MD5:3C0A1B6F538E00F318C109F4A3F29515 | SHA256:DE6CA1AE927081AC622F99AB9C77B2127CBB2DF597B4123A4AA2F3DA52CD64D5 | |||
| 4036 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF217406.TMP | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3632 | msedge.exe | GET | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/en/?subid1=20231208-0224-15a7-975e-80fa135458c6 | unknown | html | 1.13 Kb | unknown |
3632 | msedge.exe | GET | 302 | 103.224.182.253:80 | http://www.bainuoxing.com/en/ | unknown | text | 2 b | unknown |
3632 | msedge.exe | GET | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/btmsAvRer.js | unknown | text | 31.3 Kb | unknown |
3632 | msedge.exe | POST | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/_fd?subid1=20231208-0224-15a7-975e-80fa135458c6 | unknown | compressed | 2.03 Kb | unknown |
3076 | msedge.exe | GET | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/en/?subid1=20231208-0224-3145-8a33-f7411cf6f1cc | unknown | html | 1.13 Kb | unknown |
3076 | msedge.exe | GET | 302 | 103.224.182.253:80 | http://www.bainuoxing.com/en/ | unknown | text | 2 b | unknown |
3632 | msedge.exe | POST | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/_tr | unknown | compressed | 22 b | unknown |
3076 | msedge.exe | POST | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/_fd?subid1=20231208-0224-3145-8a33-f7411cf6f1cc | unknown | compressed | 2.04 Kb | unknown |
3076 | msedge.exe | POST | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/_tr | unknown | compressed | 22 b | unknown |
3076 | msedge.exe | GET | 200 | 199.59.243.225:80 | http://ww25.bainuoxing.com/bvhWMTnqN.js | unknown | text | 31.3 Kb | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4036 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3632 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3632 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3632 | msedge.exe | 20.31.251.109:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
3632 | msedge.exe | 20.105.95.163:443 | nav-edge.smartscreen.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3632 | msedge.exe | 103.224.182.253:80 | www.bainuoxing.com | Trellian Pty. Limited | AU | unknown |
Domain | IP | Reputation |
|---|---|---|
www.bainuoxing.com |
| unknown |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
nav-edge.smartscreen.microsoft.com |
| whitelisted |
data-edge.smartscreen.microsoft.com |
| whitelisted |
ww25.bainuoxing.com |
| unknown |
www.bing.com |
| whitelisted |
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com |
| whitelisted |
www.google.com |
| whitelisted |
www.adsensecustomsearchads.com |
| whitelisted |