Analysis date (UTC): 8 September 2018, 15:24Analysis environment: Windows 7 Pro, build 7601, x86

47d0a5c63cb185e28c6c88ec90c9a5207d047ed420808707066da928905bb1bf

MD5:B0BE5BDDE4D7D0A3645DD48FF1E408BD
SHA1:EEB19DA04927587A873F2B265CF4F08493F8A7F0
SHA256:47D0A5C63CB185E28C6C88EC90C9A5207D047ED420808707066DA928905BB1BF

Analysis result

Behavior activities

MALICIOUS

Application was injected by another process

  • wininit.exe (PID: 412)
  • winlogon.exe (PID: 460)
  • explorer.exe (PID: 1380)

Runs injected code in another process

  • 47d0a5c63cb185e28c6c88ec90c9a5207d047ed420808707066da928905bb1bf.exe (PID: 3520)
  • CRT6D99.tmp (PID: 3840)

Application was dropped or rewritten from another process

  • CRTA1B.tmp (PID: 2828)
  • CRT6D99.tmp (PID: 3840)
  • CRT6D99.tmp (PID: 3332)
  • mia3D5B.tmp (PID: 2396)

Downloads executable files from the Internet

  • winlogon.exe (PID: 460)

SUSPICIOUS

Creates or modifies windows services

  • winlogon.exe (PID: 460)

Connects to unusual port

  • winlogon.exe (PID: 460)
  • CRT6D99.tmp (PID: 3332)

Creates files in the Windows directory

  • winlogon.exe (PID: 460)
  • CRTA1B.tmp (PID: 2828)

Executable content was dropped or overwritten

  • winlogon.exe (PID: 460)
  • CRT6D99.tmp (PID: 3332)

Starts application with an unusual extension

  • winlogon.exe (PID: 460)
  • explorer.exe (PID: 1380)
  • CRT6D99.tmp (PID: 3332)

Uses NETSH.EXE for network configuration

  • CRT6D99.tmp (PID: 3840)
  • CRT6D99.tmp (PID: 3332)

Starts CMD.EXE for commands execution

  • CRT6D99.tmp (PID: 3840)
  • CRT6D99.tmp (PID: 3332)

Reads internet explorer settings

  • mia3D5B.tmp (PID: 2396)

INFO

Application was crashed

  • 47d0a5c63cb185e28c6c88ec90c9a5207d047ed420808707066da928905bb1bf.exe (PID: 3520)

Threats

PIDProcessClassMessage
460winlogon.exePotential Corporate Privacy ViolationET POLICY PE EXE or DLL Windows file download HTTP
460winlogon.exeMisc activityPOLICY [PTsecurity] PE as Image Content type mismatch
2828CRTA1B.tmpMisc activityADWARE [PTsecurity] Application.Bundler.ICLoader Response
2828CRTA1B.tmpA Network Trojan was detectedSC ADWARE SoftwareBundler:Win32/ICLoader
2828CRTA1B.tmpMisc AttackET DROP Dshield Block Listed Source group 1
460winlogon.exePotential Corporate Privacy ViolationET POLICY PE EXE or DLL Windows file download HTTP
460winlogon.exeMisc activityET INFO Packed Executable Download
2396mia3D5B.tmpA Network Trojan was detectedET MALWARE PPI User-Agent (InstallCapital)
2396mia3D5B.tmpMisc activityADWARE [PTsecurity] SoftwareBundler:Win32/Prepscram
2396mia3D5B.tmpA Network Trojan was detectedET MALWARE PPI User-Agent (InstallCapital)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN