download: | downloads.exe |
Full analysis: | https://app.any.run/tasks/b3b6351d-c385-4727-8242-a4c758b85d7e |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 18:27:49 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 1CABE6FA5C2A9A3BDB5CA8A41CB062CD |
SHA1: | 00D4C76539D2F462C9E58D7A17D429F99FEBE9FD |
SHA256: | 4D1CDDB804CF6C9F341B9BA36AC38803DF9B03B19984210A84F066CACC05DAD6 |
SSDEEP: | 393216:jtwR56j7QPCAwz1F0ZtD4L8K92ZW2mAs4ZuyZfsyynx7NmDOfg1YAvu2Mg57s7sj:508j8+zsZtY8i8dsjoOfg1DZV5Y7Meip |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x96fc |
UninitializedDataSize: | - |
InitializedDataSize: | 65536 |
CodeSize: | 147968 |
LinkerVersion: | 14.29 |
PEType: | PE32 |
TimeStamp: | 2021:11:09 19:16:34+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 09-Nov-2021 18:16:34 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 09-Nov-2021 18:16:34 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00024055 | 0x00024200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65105 |
.rdata | 0x00026000 | 0x0000CEA4 | 0x0000D000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.00535 |
.data | 0x00033000 | 0x0000F8B4 | 0x00000C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.89699 |
.rsrc | 0x00043000 | 0x00000630 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.49581 |
.reloc | 0x00044000 | 0x00001BE4 | 0x00001C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.6813 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.27666 | 1495 | Latin 1 / Western European | UNKNOWN | RT_MANIFEST |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3576 | "C:\Users\admin\AppData\Local\Temp\downloads.exe" | C:\Users\admin\AppData\Local\Temp\downloads.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
2076 | "C:\Users\admin\AppData\Local\Temp\downloads.exe" | C:\Users\admin\AppData\Local\Temp\downloads.exe | — | downloads.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 4294967295 Modules
| |||||||||||||||
3900 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
276 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6ed7d988,0x6ed7d998,0x6ed7d9a4 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
2576 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1060 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
2544 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1308 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Version: 86.0.4240.198 Modules
| |||||||||||||||
3260 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
2748 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
3348 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
672 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1048,5743562580394640468,8556606234793646943,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1136 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Version: 86.0.4240.198 Modules
|
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | dr |
Value: 1 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
Operation: | write | Name: | usagestats |
Value: 0 | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | metricsid |
Value: | |||
(PID) Process: | (3900) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
Operation: | write | Name: | metricsid_installdate |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_chacha20.pyd | executable | |
MD5:451D863458F6B65B56B1AC7FDC8D5F8D | SHA256:7EECB87578526315BC4C2617802620468907C4A66923DAF08470C490F03AA5DE | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_arc2.pyd | executable | |
MD5:44D2C7A178D403E771D944950374D865 | SHA256:6379C58CC3C7017DB249B14D8708678420872D165040278ACEC947C4713E598F | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_pkcs1_decode.pyd | executable | |
MD5:0F89EB1217F3D4DA4D708C5545F8168F | SHA256:069130594D10F2C701FAE8FE2FA360B92A1A67E54DE001C7874619CE55804ED6 | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Hash\_BLAKE2s.pyd | executable | |
MD5:8ECDE97115E6DBFC7CF5F6925351A9A0 | SHA256:E37C84A556F918BF095123900AEFEBA0104D2451ADCCCD3D95C9EF604F81A755 | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_blowfish.pyd | executable | |
MD5:719A46CA7041302B3F8A7CE8CE8DC619 | SHA256:4A4EE02533B1FF51B6F13781D57FB7FF0FA11B2A219AF601EF5BE6B4E01D9F7D | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_aes.pyd | executable | |
MD5:7076F974FC82D571348028369E37EC25 | SHA256:D52F50AD7ECB170EA35B508F301F4A4D0F40CF7A6505EC1253F431BAB62A1326 | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_aesni.pyd | executable | |
MD5:C14F3A8A2ABD431A93BF2651F4ED7FE0 | SHA256:8D0EB66C634590EA2DAE7A2815F6731AA45B9AEB8A3FD3AAF0C88C575D1B2685 | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_ctr.pyd | executable | |
MD5:395F8173A0828691C137E03D4C0B751E | SHA256:0CA8E51B9A5F677CF273F34691D5B81EF40DA0F28C6367926CF7D07469B9ECFE | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_ARC4.pyd | executable | |
MD5:7C67DD717AEAC76E4F815A1815B0E132 | SHA256:99B4AA473EE0B96EAD7E1FD671D56D574D5E68002A0085EE2F417B130AC29FF8 | |||
3576 | downloads.exe | C:\Users\admin\AppData\Local\Temp\_MEI35762\Crypto\Cipher\_raw_cast.pyd | executable | |
MD5:82443D3059B3A1AB168F313C57B88D02 | SHA256:04F3BA50B54066CE0E8CB67D6214020A1A4FD01870F95D1517A23F5C5A31DB70 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | — | — | whitelisted |
— | — | HEAD | 200 | 194.9.24.78:80 | http://r3---sn-5uh5o-f5f6.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3?cms_redirect=yes&mh=bj&mip=188.212.135.169&mm=28&mn=sn-5uh5o-f5f6&ms=nvh&mt=1653071060&mv=m&mvi=3&pl=24&rmhost=r5---sn-5uh5o-f5f6.gvt1.com&shardbypass=sd | PL | — | — | whitelisted |
2544 | chrome.exe | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | html | 563 b | whitelisted |
2544 | chrome.exe | GET | 302 | 216.239.38.21:80 | http://virustotal.com/ | US | — | — | whitelisted |
— | — | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | html | 582 b | whitelisted |
— | — | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | html | 582 b | whitelisted |
— | — | GET | 206 | 194.9.24.78:80 | http://r3---sn-5uh5o-f5f6.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3?cms_redirect=yes&mh=bj&mip=188.212.135.169&mm=28&mn=sn-5uh5o-f5f6&ms=nvh&mt=1653071304&mv=m&mvi=3&pl=24&rmhost=r5---sn-5uh5o-f5f6.gvt1.com&shardbypass=sd | PL | binary | 20.7 Kb | whitelisted |
— | — | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | html | 582 b | whitelisted |
— | — | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | html | 582 b | whitelisted |
— | — | GET | 302 | 142.250.186.142:80 | http://redirector.gvt1.com/edgedl/release2/chrome_component/adktovjj3t3n7jwiiegl5h6y3v5q_1.3.36.121/ihnlcenocehgdaegdmhbidjhnhdchfmm_1.3.36.121_win_bxugoraqoudfswxg22hsatfdbi.crx3 | US | html | 582 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2544 | chrome.exe | 142.250.184.196:443 | www.google.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.250.184.237:443 | accounts.google.com | Google Inc. | US | suspicious |
2544 | chrome.exe | 216.239.38.21:80 | virustotal.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.250.185.67:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.251.37.97:443 | clients2.googleusercontent.com | Google Inc. | US | unknown |
2544 | chrome.exe | 142.250.184.195:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.250.186.142:80 | redirector.gvt1.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.250.186.131:443 | www.recaptcha.net | Google Inc. | US | whitelisted |
2544 | chrome.exe | 216.239.38.21:443 | virustotal.com | Google Inc. | US | whitelisted |
2544 | chrome.exe | 142.250.185.174:443 | clients2.google.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.google.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
accounts.google.com |
| shared |
clients2.google.com |
| whitelisted |
clients2.googleusercontent.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
virustotal.com |
| whitelisted |
www.virustotal.com |
| whitelisted |
www.recaptcha.net |
| whitelisted |