analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Wsp1Y2kaMZ5npFn.exe

Full analysis: https://app.any.run/tasks/cc444812-2b59-498f-a2f6-330fb4ec81ae
Verdict: Malicious activity
Analysis date: September 30, 2020, 13:47:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

05E6D0FEC133B11165F4DB25F7256682

SHA1:

609AF629DA07AE0EBBE39C2DE2502752F5E4553F

SHA256:

6030FAADAE8D2AA1B94B06DA9C0D4ED3CE33076A1BC04218027519B1043A6A95

SSDEEP:

12288:P+jP6eP9b2N+P7SeThWBfeiRR/Zqa5vQLuB0pnebzv019XdctgSq3X0OywVtBycv:GjP6+3P7SG8Rh51819tN7VtB7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • Wsp1Y2kaMZ5npFn.exe (PID: 2896)
  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 1884)
    • Reads the machine GUID from the registry

      • DllHost.exe (PID: 1868)
      • rundll32.exe (PID: 960)
    • Executed via COM

      • DllHost.exe (PID: 1868)
    • Creates files in the user directory

      • powershell.exe (PID: 2892)
    • Checks supported languages

      • Wsp1Y2kaMZ5npFn.exe (PID: 2896)
    • Application launched itself

      • Wsp1Y2kaMZ5npFn.exe (PID: 2208)
    • Executes PowerShell scripts

      • Wsp1Y2kaMZ5npFn.exe (PID: 2896)
    • Checks for external IP

      • Wsp1Y2kaMZ5npFn.exe (PID: 2896)
  • INFO

    • Reads settings of System Certificates

      • Wsp1Y2kaMZ5npFn.exe (PID: 2896)
    • Manual execution by user

      • control.exe (PID: 1884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:09:28 23:57:21+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 884224
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xd9c06
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.0
ProductVersionNumber: 1.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: A Library which easy advance the Functions are given for the WinForms ListView. We also add a new ListViewControl based on GlacialList.
CompanyName: Badget
FileDescription: Badget.LibListview
FileVersion: 1.1.0.0
InternalName: Iف.exe
LegalCopyright: Copyright © 2016 Badget Libraries, All Rights reserved.
LegalTrademarks: -
OriginalFileName: Iف.exe
ProductName: Badget.LibListview
ProductVersion: 1.1.0.0
AssemblyVersion: 1.1.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 28-Sep-2020 21:57:21
Comments: A Library which easy advance the Functions are given for the WinForms ListView. We also add a new ListViewControl based on GlacialList.
CompanyName: Badget
FileDescription: Badget.LibListview
FileVersion: 1.1.0.0
InternalName: Iف.exe
LegalCopyright: Copyright © 2016 Badget Libraries, All Rights reserved.
LegalTrademarks: -
OriginalFilename: Iف.exe
ProductName: Badget.LibListview
ProductVersion: 1.1.0.0
Assembly Version: 1.1.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 28-Sep-2020 21:57:21
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x000D7C0C
0x000D7E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.72401
.reloc
0x000DA000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191
.rsrc
0x000DC000
0x000006E4
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.43476

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.94168
436
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wsp1y2kamz5npfn.exe no specs control.exe no specs rundll32.exe no specs timedate.cpl no specs wsp1y2kamz5npfn.exe powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2208"C:\Users\admin\Desktop\Wsp1Y2kaMZ5npFn.exe" C:\Users\admin\Desktop\Wsp1Y2kaMZ5npFn.exeexplorer.exe
User:
admin
Company:
Badget
Integrity Level:
MEDIUM
Description:
Badget.LibListview
Exit code:
0
Version:
1.1.0.0
1884"C:\Windows\System32\control.exe" "C:\Windows\system32\timedate.cpl",C:\Windows\System32\control.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
960"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\timedate.cpl",C:\Windows\system32\rundll32.execontrol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1868C:\Windows\system32\DllHost.exe /Processid:{9DF523B0-A6C0-4EA9-B5F1-F4565C3AC8B8}C:\Windows\system32\DllHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2896"{path}"C:\Users\admin\Desktop\Wsp1Y2kaMZ5npFn.exe
Wsp1Y2kaMZ5npFn.exe
User:
admin
Company:
Badget
Integrity Level:
MEDIUM
Description:
Badget.LibListview
Exit code:
0
Version:
1.1.0.0
2892"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\admin\Desktop\Wsp1Y2kaMZ5npFn.exe'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWsp1Y2kaMZ5npFn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
291
Read events
210
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2896Wsp1Y2kaMZ5npFn.exeC:\Users\admin\AppData\Local\Temp\CabD452.tmp
MD5:
SHA256:
2896Wsp1Y2kaMZ5npFn.exeC:\Users\admin\AppData\Local\Temp\TarD453.tmp
MD5:
SHA256:
2892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VM399LJCKFBP95N20F9N.temp
MD5:
SHA256:
2896Wsp1Y2kaMZ5npFn.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:74B81205695405C0262D63A43451868E
SHA256:2C9CA21247D82DCF8C5C4374871F73C832EF0A514FF7FAA89F5FFBDF60CAB397
2892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:EB523AAF18B06AAECCCF507F6DF321C2
SHA256:4B696A0868554AC65C1F8EB1FEFF61C53C15D8389B42786313D1EDED95596693
2896Wsp1Y2kaMZ5npFn.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:2033657BF48D4EA6617C97E7ED006869
SHA256:A936F2632751E0BCAA41E3505179DC6D276D966BB019628B556948B1B97648D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2896
Wsp1Y2kaMZ5npFn.exe
GET
200
23.21.109.69:80
http://api.ipify.org/
US
text
13 b
shared
2896
Wsp1Y2kaMZ5npFn.exe
GET
200
67.27.158.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?856455ff859593b2
US
compressed
57.5 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2896
Wsp1Y2kaMZ5npFn.exe
23.21.109.69:80
api.ipify.org
Amazon.com, Inc.
US
shared
2896
Wsp1Y2kaMZ5npFn.exe
67.27.158.126:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2896
Wsp1Y2kaMZ5npFn.exe
103.6.196.138:587
mail.porathacorp.com
Exa Bytes Network Sdn.Bhd.
MY
malicious

DNS requests

Domain
IP
Reputation
api.ipify.org
  • 23.21.109.69
  • 54.227.255.202
  • 174.129.214.20
  • 54.225.66.103
  • 54.225.169.28
  • 50.19.252.36
  • 23.21.126.66
  • 184.73.247.141
shared
mail.porathacorp.com
  • 103.6.196.138
malicious
ctldl.windowsupdate.com
  • 67.27.158.126
  • 67.27.233.254
  • 67.26.139.254
  • 8.253.207.121
  • 67.27.234.126
whitelisted

Threats

PID
Process
Class
Message
2896
Wsp1Y2kaMZ5npFn.exe
Misc activity
SUSPICIOUS [PTsecurity] External IP Lookup (possible MassLogger)
2896
Wsp1Y2kaMZ5npFn.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup api.ipify.org
2896
Wsp1Y2kaMZ5npFn.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info