URL: | http://down.kuwo.cn/mbox/sogou_music.exe |
Full analysis: | https://app.any.run/tasks/1db778d8-6f58-4665-ad98-d4cc8a4d2114 |
Verdict: | Malicious activity |
Analysis date: | April 24, 2019, 07:48:11 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MD5: | F1961006BDF8FE8401AE9026715BFFD9 |
SHA1: | 8E54AA3978C9A5DDC2BA66E931D7EB9F709B83CA |
SHA256: | 4A2540C56352CD4F23DE2EDC9C2BE462734CC5764884E87CDC2C4631BD1A54A7 |
SSDEEP: | 3:N1KaKZQSYKCKsMk:CatSJm |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3856 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
2760 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3856 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
388 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sogou_music[1].exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sogou_music[1].exe | — | iexplore.exe |
User: admin Company: 酷我科技 Integrity Level: MEDIUM Description: 酷我音乐 Exit code: 3221226540 Version: 9.0.4.0 | ||||
1520 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sogou_music[1].exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sogou_music[1].exe | iexplore.exe | |
User: admin Company: 酷我科技 Integrity Level: HIGH Description: 酷我音乐 Version: 9.0.4.0 | ||||
920 | "C:\Users\admin\AppData\Local\Temp\curl.exe" -d MiUwOTxTUkM6TVVTSUNfOS4wLjQuMF9TRzF8QUNUOklOU1RBTExfSU5GT3xUWVBFOlN0YXJ0U2V0dXB8VENvdW50OjExNjM1OTN8e3NvZ291X211c2ljWzFdLmV4ZX18VTp8TUFDOjUyNTQwMDRBMDRBRj4= http://log.kuwo.cn/music.yl -o C:\Users\admin\AppData\Local\Temp\kuwomsglog.txt | C:\Users\admin\AppData\Local\Temp\curl.exe | sogou_music[1].exe | |
User: admin Company: cURL, https://curl.haxx.se/ Integrity Level: HIGH Description: The cURL executable Exit code: 0 Version: 7.48.0 | ||||
3484 | "C:\Users\admin\AppData\Local\Temp\KwBindApp.exe" /DownCfg /Ver=MUSIC_9.0.4.0_SG1 /Src=sogou_music[1].exe | C:\Users\admin\AppData\Local\Temp\KwBindApp.exe | sogou_music[1].exe | |
User: admin Integrity Level: HIGH Exit code: 0 | ||||
2848 | "C:\Users\admin\AppData\Local\Temp\KWMUSIC\duPlugab.exe" | C:\Users\admin\AppData\Local\Temp\KWMUSIC\duPlugab.exe | KwBindApp.exe | |
User: admin Company: 酷我音乐 Integrity Level: HIGH Description: 酷我音乐在线安装程序 Exit code: 0 Version: 1.1.0.0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3856 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
3856 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3856 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF6607033C97D062F6.TMP | — | |
MD5:— | SHA256:— | |||
2760 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZXYTFKBX\sogou_music[1].exe | — | |
MD5:— | SHA256:— | |||
3856 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\sogou_music[1].exe | — | |
MD5:— | SHA256:— | |||
3856 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{57574360-6665-11E9-A370-5254004A04AF}.dat | binary | |
MD5:17ECDA9D65C5EDD42CD8E7F706879E95 | SHA256:1DCC80EF81D22670A86DB7D65CAB1D0E0EE7BB6CE8741C5A81032884A15F7344 | |||
2760 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019042420190425\index.dat | dat | |
MD5:94D3BBFB362DBC0E37E4B58FDBC55239 | SHA256:8D16B4B25DF2F5FD1A0470A36BAF20FF888AF4B7D8E9046806F3546030D02A89 | |||
2760 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
2760 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:83A4F98C531C08F54B90380F2DEF53C9 | SHA256:289F996CE100F44AFBFE0BB49CA7DE7757FB2D4A2547BB2A98CEEB7C1DBA7A0D | |||
1520 | sogou_music[1].exe | C:\Users\admin\AppData\Local\Temp\curl.exe | executable | |
MD5:6B535F795BF0325178A4DF17CE4AD09C | SHA256:264D69E8A7CA1AFCDF4179429D74A9098187C3F8A5E06080D2758682313A42B4 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
920 | curl.exe | POST | 200 | 175.102.178.41:80 | http://log.kuwo.cn/music.yl | CN | text | 12 b | malicious |
3484 | KwBindApp.exe | POST | 200 | 175.102.178.43:80 | http://log.kuwo.cn/music.yl | CN | text | 12 b | malicious |
3484 | KwBindApp.exe | POST | 200 | 175.102.178.43:80 | http://log.kuwo.cn/music.yl | CN | text | 12 b | malicious |
2848 | duPlugab.exe | POST | 200 | 60.28.200.72:80 | http://config.kuwo.cn/uc/s?m=47;SV4oOTomLX9AS1VCXUFefyoiVEAaAAlPDDoIGRoGDXtIOEsJEQpCQhALAR8GCRo= | CN | text | 76 b | malicious |
3856 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3856 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2848 | duPlugab.exe | 60.28.200.72:80 | config.kuwo.cn | CHINA UNICOM China169 Backbone | CN | suspicious |
920 | curl.exe | 175.102.178.41:80 | log.kuwo.cn | — | CN | malicious |
2760 | iexplore.exe | 117.27.232.41:80 | down.kuwo.cn | Fuzhou | CN | malicious |
3484 | KwBindApp.exe | 175.102.178.43:80 | log.kuwo.cn | — | CN | malicious |
Domain | IP | Reputation |
---|---|---|
www.bing.com |
| whitelisted |
down.kuwo.cn |
| malicious |
log.kuwo.cn |
| unknown |
config.kuwo.cn |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2760 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2760 | iexplore.exe | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
920 | curl.exe | Attempted Information Leak | ET POLICY curl User-Agent Outbound |
2848 | duPlugab.exe | A Network Trojan was detected | ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers |
2848 | duPlugab.exe | A Network Trojan was detected | MALWARE [PTsecurity] GrayWare[Downloader]/Win32.Adload.gen Check-in |
Process | Message |
---|---|
sogou_music[1].exe | kuWoNsis::GetUserID,szPath ??,??!!! |
duPlugab.exe | inetc DllMain DLL_PROCESS_ATTACH SetUnhandledExceptionFilter(UnhandledExceptionFilterCallback) |
duPlugab.exe | inetc mySendRequest enter. |
duPlugab.exe | inetc mySendRequest leave. |
sogou_music[1].exe | DrawChildCtrl
|
sogou_music[1].exe | DrawChildCtrl
|
sogou_music[1].exe | DrawChildCtrl
|
sogou_music[1].exe | DrawChildCtrl
|
sogou_music[1].exe | DrawChildCtrl
|
sogou_music[1].exe | DrawChildCtrl
|