File name: | C:\Users\admin\Desktop\oiu0.8315073219590121.exe |
Full analysis: | https://app.any.run/tasks/a2a9cf4b-4f1d-4f8d-ada7-c81f52e569db |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 06:06:29 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 981C0D16EEF0B35259EE8232CDC90B1C |
SHA1: | F380C7FD9AFE826CDC4C0E3D7DD58685B51CE0BE |
SHA256: | 6560A915088D6F9833F2AE3C533E77373902759F7C581FC4925F6F05E87F6108 |
SSDEEP: | 12288:bnGxtGknlMLx7BXyst/owVc/Q6hsYTgRf3/J/QLjN:CxMkniCst/owZA51 |
.exe | | | Clipper DOS Executable (33.5) |
---|---|---|
.exe | | | Generic Win/DOS Executable (33.2) |
.exe | | | DOS Executable Generic (33.2) |
ProductVersion: | 6.00.2900.5931 |
---|---|
ProductName: | Microsoft® Windows® Operating System |
OriginalFileName: | MSOE.DLL |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
InternalName: | MSOE |
FileVersion: | 6.00.2900.5931 (xpsp_sp3_gdr.100129-1321) |
FileDescription: | Outlook Express |
CompanyName: | Microsoft Corporation |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 6.0.2900.5931 |
FileVersionNumber: | 6.0.2900.5931 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x4e000 |
UninitializedDataSize: | - |
InitializedDataSize: | 232656 |
CodeSize: | 81920 |
LinkerVersion: | 8 |
PEType: | PE32 |
TimeStamp: | 2008:06:24 20:47:18+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 24-Jun-2008 18:47:18 |
Detected languages: |
|
CompanyName: | Microsoft Corporation |
FileDescription: | Outlook Express |
FileVersion: | 6.00.2900.5931 (xpsp_sp3_gdr.100129-1321) |
InternalName: | MSOE |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
OriginalFilename: | MSOE.DLL |
ProductName: | Microsoft® Windows® Operating System |
ProductVersion: | 6.00.2900.5931 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000044 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 6 |
Time date stamp: | 24-Jun-2008 18:47:18 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00014000 | 0x00013200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.21508 |
.rdata | 0x00015000 | 0x00027000 | 0x00027000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.77987 |
.data | 0x0003C000 | 0x00009000 | 0x00003C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.66041 |
.idata | 0x00045000 | 0x00002DC0 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.33382 |
.rsrc | 0x00048000 | 0x00005F10 | 0x00005600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.01548 |
.nkh\x07 | 0x0004E000 | 0x00001000 | 0x00000600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.96347 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.57065 | 892 | Latin 1 / Western European | English - United States | RT_VERSION |
OBJXPL | 2.58685 | 446 | Latin 1 / Western European | English - United States | XPL |
ADVAPI32.dll |
GDI32.dll |
KERNEL32.dll |
ODBC32.dll |
OLEACC.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
VERSION.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2836 | "C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\AppData\Local\Temp\oiu0.8315073219590121.exe | C:\Windows\System32\runas.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Run As Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3312 | C:\Users\admin\AppData\Local\Temp\oiu0.8315073219590121.exe | C:\Users\admin\AppData\Local\Temp\oiu0.8315073219590121.exe | runas.exe | ||||||||||||
User: Administrator Company: Microsoft Corporation Integrity Level: HIGH Description: Outlook Express Version: 6.00.2900.5931 (xpsp_sp3_gdr.100129-1321) Modules
| |||||||||||||||
4064 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3648 | "C:\Windows\system32\calc.exe" | C:\Windows\system32\calc.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Calculator Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2724 | "C:\Windows\system32\mspaint.exe" | C:\Windows\system32\mspaint.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Paint Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3616 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
4024 | "C:\Windows\system32\StikyNot.exe" | C:\Windows\system32\StikyNot.exe | Explorer.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Sticky Notes Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3548 | "C:\Windows\system32\SoundRecorder.exe" | C:\Windows\system32\SoundRecorder.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Sound Recorder Exit code: 3221225547 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2176 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2448 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\system32\taskmgr.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
Operation: | write | Name: | HideSCAHealth |
Value: 1 | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\.exe |
Operation: | write | Name: | (default) |
Value: hcf | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf |
Operation: | write | Name: | (default) |
Value: Application | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf |
Operation: | write | Name: | Content Type |
Value: application/x-msdownload | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\DefaultIcon |
Operation: | write | Name: | (default) |
Value: %1 | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\shell\open\command |
Operation: | write | Name: | (default) |
Value: "C:\Users\Administrator\AppData\Local\gzp.exe" -a "%1" %* | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\shell\open\command |
Operation: | write | Name: | IsolatedCommand |
Value: "%1" %* | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\shell\runas\command |
Operation: | write | Name: | (default) |
Value: "%1" %* | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\shell\runas\command |
Operation: | write | Name: | IsolatedCommand |
Value: "%1" %* | |||
(PID) Process: | (3312) oiu0.8315073219590121.exe | Key: | HKEY_CLASSES_ROOT\hcf\shell\start\command |
Operation: | write | Name: | (default) |
Value: "%1" %* |
PID | Process | Filename | Type | |
---|---|---|---|---|
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat | edb | |
MD5:1C1EAEB5DEEB69D0AE6AADA63AF47716 | SHA256:722369D70F466A045EC3B0098452CFFE25663590546C81B2836A4ED91A1815C8 | |||
4024 | StikyNot.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G2RE9ASQMHXNW3GUEIKD.temp | binary | |
MD5:EDD8D9091B3C76AC90B87BBE47ABE5AC | SHA256:2B4318964976E73803D96029FC0FC30E286C5F1995A0BDAF0098F0C860820EE3 | |||
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log | binary | |
MD5:39A6BB58B49104D3BF2899542AF08C7F | SHA256:8D4134EBAAC6A25CE41C0788ACD567BBBBA5A3B9F9009421696D0018B88B7C07 | |||
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.log | binary | |
MD5:39A6BB58B49104D3BF2899542AF08C7F | SHA256:8D4134EBAAC6A25CE41C0788ACD567BBBBA5A3B9F9009421696D0018B88B7C07 | |||
4024 | StikyNot.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\337ed59af273c758.customDestinations-ms | binary | |
MD5:EDD8D9091B3C76AC90B87BBE47ABE5AC | SHA256:2B4318964976E73803D96029FC0FC30E286C5F1995A0BDAF0098F0C860820EE3 | |||
3312 | oiu0.8315073219590121.exe | C:\Users\Administrator\AppData\Local\gzp.exe | executable | |
MD5:981C0D16EEF0B35259EE8232CDC90B1C | SHA256:6560A915088D6F9833F2AE3C533E77373902759F7C581FC4925F6F05E87F6108 | |||
3548 | SoundRecorder.exe | C:\Users\admin\AppData\Local\Temp\ARTF412.tmp | wmv | |
MD5:BB0CBF6A111B233B571148A4DDB7E44A | SHA256:BF4F7C2B1ACEA70349316949F688D03B597929EAD03CA4EDA7B5E29DAE81570E | |||
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\V01.chk | binary | |
MD5:A0A8B3C4C5D6A50E3C7F8035E3C44071 | SHA256:FC76954C012A37D2225308FF468242E82A9D0F498AFC42D1EAE0E8353B5FFC0C | |||
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q5UI5QUF\errorPageStrings[1] | text | |
MD5:6B26ECFA58E37D4B5EC861FCDD3F04FA | SHA256:7F7D1069CA8A852C1C8EB36E1D988FE6A9C17ECB8EFF1F66FC5EBFEB5418723A | |||
3916 | DllHost.exe | C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q5UI5QUF\NewErrorPageTemplate[1] | text | |
MD5:CDF81E591D9CBFB47A7F97A2BCDB70B9 | SHA256:204D95C6FB161368C795BB63E538FE0B11F9E406494BB5758B3B0D60C5F651BD |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3312 | oiu0.8315073219590121.exe | 20.84.181.62:80 | microsoft.com | — | US | suspicious |
3312 | oiu0.8315073219590121.exe | 20.103.85.33:80 | microsoft.com | — | US | suspicious |
— | — | 20.103.85.33:80 | microsoft.com | — | US | suspicious |
Domain | IP | Reputation |
---|---|---|
vuforazaj.com |
| unknown |
fyzybopufanuj.com |
| unknown |
nyzysemadyk.com |
| suspicious |
gavotataran.com |
| unknown |
pubepujiwusiwy.com |
| unknown |
zetofyhecynovu.com |
| unknown |
hypulycyfaqaba.com |
| unknown |
rehudomydefe.com |
| unknown |
vequtycarykeg.com |
| unknown |
sesycifaqago.com |
| unknown |