File name:

69bf2.Virus.exe

Full analysis: https://app.any.run/tasks/b4e2ca21-0c58-414b-b0ce-7803744640a6
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: February 14, 2022, 00:36:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

5999A3F15FB4127A8E0C5F1B787482E7

SHA1:

0EDE994354D9BD1D384781FDE96B02EA8285A7F7

SHA256:

69BF2937BB27A92245B10FDDAFE7A4D46B8D53BE94F930A5B3CF76B9CB51853C

SSDEEP:

12288:i0Djqk+hA0uMmj4a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:dDj/v0gXe4i7ojhsP5Lgrk1TWb4AN5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • 69bf2.Virus.exe (PID: 1040)

    • Loads the Task Scheduler COM API

      • ehRecvr.exe (PID: 1340)
      • ehRec.exe (PID: 872)
      • OSPPSVC.EXE (PID: 4060)
      • GoogleUpdate.exe (PID: 1012)

    • Application was dropped or rewritten from another process

      • fxssvc.exe (PID: 3672)
      • GoogleUpdate.exe (PID: 1012)
      • alg.exe (PID: 2724)
      • GoogleUpdate.exe (PID: 3056)
      • mscorsvw.exe (PID: 1740)
      • GoogleUpdate.exe (PID: 1132)
      • ehsched.exe (PID: 3704)
      • GoogleUpdate.exe (PID: 2936)
      • aspnet_state.exe (PID: 2932)
      • ehRecvr.exe (PID: 1340)
      • mscorsvw.exe (PID: 3320)
      • elevation_service.exe (PID: 1512)
      • msdtc.exe (PID: 2856)
      • maintenanceservice.exe (PID: 3196)
      • OSE.EXE (PID: 3900)
      • IEEtwCollector.exe (PID: 3352)
      • GoogleUpdate.exe (PID: 3136)
      • armsvc.exe (PID: 3172)
      • OSPPSVC.EXE (PID: 4060)

    • Connects to CnC server

      • 69bf2.Virus.exe (PID: 1040)

  • SUSPICIOUS

    • Checks supported languages

      • 69bf2.Virus.exe (PID: 1040)
      • aspnet_state.exe (PID: 2932)
      • mscorsvw.exe (PID: 1740)
      • mscorsvw.exe (PID: 3320)
      • ehRecvr.exe (PID: 1340)
      • ehsched.exe (PID: 3704)
      • EhTray.exe (PID: 1324)
      • elevation_service.exe (PID: 1512)
      • GoogleUpdate.exe (PID: 3056)
      • GoogleUpdate.exe (PID: 1012)
      • maintenanceservice.exe (PID: 3196)
      • ehRec.exe (PID: 872)
      • armsvc.exe (PID: 3172)
      • OSE.EXE (PID: 3900)
      • OSPPSVC.EXE (PID: 4060)
      • GoogleCrashHandler.exe (PID: 656)
      • GoogleUpdate.exe (PID: 1132)
      • GoogleUpdate.exe (PID: 2936)
      • GoogleUpdate.exe (PID: 3136)

    • Creates files in the user directory

      • 69bf2.Virus.exe (PID: 1040)
      • EhTray.exe (PID: 1324)

    • Reads the computer name

      • aspnet_state.exe (PID: 2932)
      • 69bf2.Virus.exe (PID: 1040)
      • mscorsvw.exe (PID: 3320)
      • ehRecvr.exe (PID: 1340)
      • mscorsvw.exe (PID: 1740)
      • ehsched.exe (PID: 3704)
      • EhTray.exe (PID: 1324)
      • elevation_service.exe (PID: 1512)
      • GoogleUpdate.exe (PID: 3056)
      • GoogleUpdate.exe (PID: 1012)
      • ehRec.exe (PID: 872)
      • maintenanceservice.exe (PID: 3196)
      • OSPPSVC.EXE (PID: 4060)
      • armsvc.exe (PID: 3172)
      • OSE.EXE (PID: 3900)
      • GoogleUpdate.exe (PID: 1132)
      • GoogleUpdate.exe (PID: 2936)
      • GoogleUpdate.exe (PID: 3136)

    • Executed as Windows Service

      • alg.exe (PID: 2724)
      • aspnet_state.exe (PID: 2932)
      • ehRecvr.exe (PID: 1340)
      • ehsched.exe (PID: 3704)
      • fxssvc.exe (PID: 3672)
      • elevation_service.exe (PID: 1512)
      • GoogleUpdate.exe (PID: 3056)
      • maintenanceservice.exe (PID: 3196)
      • IEEtwCollector.exe (PID: 3352)
      • msdtc.exe (PID: 2856)
      • armsvc.exe (PID: 3172)
      • OSE.EXE (PID: 3900)
      • GoogleUpdate.exe (PID: 3136)

    • Creates files in the Windows directory

      • mscorsvw.exe (PID: 1740)
      • alg.exe (PID: 2724)
      • mscorsvw.exe (PID: 3320)
      • fxssvc.exe (PID: 3672)
      • msdtc.exe (PID: 2856)

    • Executable content was dropped or overwritten

      • 69bf2.Virus.exe (PID: 1040)
      • alg.exe (PID: 2724)

    • Drops a file with too old compile date

      • 69bf2.Virus.exe (PID: 1040)
      • alg.exe (PID: 2724)

    • Drops a file that was compiled in debug mode

      • 69bf2.Virus.exe (PID: 1040)
      • alg.exe (PID: 2724)

    • Creates files in the program directory

      • fxssvc.exe (PID: 3672)
      • maintenanceservice.exe (PID: 3196)
      • ehRec.exe (PID: 872)
      • GoogleUpdate.exe (PID: 1132)

    • Application launched itself

      • GoogleUpdate.exe (PID: 3056)
      • GoogleUpdate.exe (PID: 1012)

    • Executed via COM

      • ehRec.exe (PID: 872)

    • Reads Environment values

      • msdtc.exe (PID: 2856)

    • Creates a directory in Program Files

      • GoogleUpdate.exe (PID: 1132)

    • Drops a file with a compile date too recent

      • alg.exe (PID: 2724)

  • INFO

    • Checks supported languages

      • alg.exe (PID: 2724)
      • fxssvc.exe (PID: 3672)
      • IEEtwCollector.exe (PID: 3352)
      • msdtc.exe (PID: 2856)

    • Reads the computer name

      • alg.exe (PID: 2724)
      • fxssvc.exe (PID: 3672)
      • IEEtwCollector.exe (PID: 3352)
      • msdtc.exe (PID: 2856)

    • Manual execution by user

      • EhTray.exe (PID: 1324)

    • Reads Microsoft Office registry keys

      • OSPPSVC.EXE (PID: 4060)

    • Reads settings of System Certificates

      • GoogleUpdate.exe (PID: 1132)
      • GoogleUpdate.exe (PID: 3136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

ProductVersion: 1.2.10.1
ProductName: PalitExplorer
OriginalFileName: PalitExplorer.exe
LegalCopyright: Palit
InternalName: PalitExplorer.exe
FileVersion: 3.22.19.1
FileDescription: Explorer
CompanyName: Palit
CharacterSet: Unicode
LanguageCode: French (Canadian)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.2.10.1
FileVersionNumber: 3.22.19.1
Subsystem: Windows command line
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0xffda
UninitializedDataSize: -
InitializedDataSize: 19456
CodeSize: 113152
LinkerVersion: 14.25
PEType: PE32
TimeStamp: 2021:12:21 12:49:55+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 21-Dec-2021 11:49:55
Detected languages:
  • English - United States
  • French - Canada
CompanyName: Palit
FileDescription: Explorer
FileVersion: 3.22.19.1
InternalName: PalitExplorer.exe
LegalCopyright: Palit
OriginalFilename: PalitExplorer.exe
ProductName: PalitExplorer
ProductVersion: 1.2.10.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Dec-2021 11:49:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.polik
0x00001000
0x0001B9B0
0x0001BA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.44889
.data
0x0001D000
0x00001644
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.35548
.idata
0x0001F000
0x000007FA
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.40798
.rsrc
0x00020000
0x00001628
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.04187
.reloc
0x00022000
0x001CF000
0x0012F000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.67979

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
143
1.7815
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
24
Malicious processes
13
Suspicious processes
8

Behavior graph

Click at the process to see the details
start 69bf2.virus.exe alg.exe aspnet_state.exe no specs mscorsvw.exe no specs mscorsvw.exe no specs ehrecvr.exe no specs ehsched.exe no specs ehtray.exe no specs fxssvc.exe no specs elevation_service.exe no specs googleupdate.exe no specs googleupdate.exe no specs ieetwcollector.exe no specs googleupdate.exe ehrec.exe no specs maintenanceservice.exe no specs msdtc.exe no specs armsvc.exe no specs ose.exe no specs osppsvc.exe no specs googlecrashhandler.exe no specs googleupdate.exe no specs googleupdate.exe 69bf2.virus.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
656"C:\Program Files\Google\Update\1.3.36.32\GoogleCrashHandler.exe"C:\Program Files\Google\Update\1.3.36.32\GoogleCrashHandler.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.31
872C:\Windows\ehome\ehRec.exe -EmbeddingC:\Windows\ehome\ehRec.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Media Center Host Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1012"C:\Program Files\Google\Update\GoogleUpdate.exe" /cC:\Program Files\Google\Update\GoogleUpdate.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google Inc.
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
1040"C:\Users\admin\AppData\Local\Temp\69bf2.Virus.exe" C:\Users\admin\AppData\Local\Temp\69bf2.Virus.exe
Explorer.EXE
User:
admin
Company:
Palit
Integrity Level:
HIGH
Description:
Explorer
Exit code:
5
Version:
3.22.19.1
1132"C:\Program Files\Google\Update\GoogleUpdate.exe" /crC:\Program Files\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
SYSTEM
Company:
Google Inc.
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
1324"C:\Windows\eHome\EhTray.exe" /nav:-2C:\Windows\eHome\EhTray.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Center
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1340C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Media Center Receiver Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1512"C:\Program Files\Google\Chrome\Application\86.0.4240.198\elevation_service.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.198\elevation_service.exe—services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
1740C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
.NET Runtime Optimization Service
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
2656"C:\Users\admin\AppData\Local\Temp\69bf2.Virus.exe" C:\Users\admin\AppData\Local\Temp\69bf2.Virus.exe—Explorer.EXE
User:
admin
Company:
Palit
Integrity Level:
MEDIUM
Description:
Explorer
Exit code:
3221226540
Version:
3.22.19.1
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
174
Suspicious files
8
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
104069bf2.Virus.exeC:\Users\admin\AppData\Roaming\c4ba3647fd0d6918.binbinary
MD5:—
SHA256:—
2724alg.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\c4ba3647fd0d6918.binbinary
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\System32\alg.exeexecutable
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exeexecutable
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeexecutable
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeexecutable
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\ehome\ehRecvr.exeexecutable
MD5:—
SHA256:—
1740mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.logtext
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\system32\IEEtwCollector.exeexecutable
MD5:—
SHA256:—
104069bf2.Virus.exeC:\Windows\ehome\ehsched.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
112
TCP/UDP connections
130
DNS requests
146
Threats
153

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1040
69bf2.Virus.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
xml
345 b
malicious
1040
69bf2.Virus.exe
POST
404
172.105.27.61:80
http://ssbzmoy.biz/tudsnvrnt
US
xml
341 b
malicious
1040
69bf2.Virus.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
xml
345 b
malicious
1040
69bf2.Virus.exe
GET
404
104.21.5.208:80
http://wfsdragon.ru/api/setStats.php
US
xml
341 b
malicious
1040
69bf2.Virus.exe
GET
404
2.56.59.42:80
http://2.56.59.42/base/api/statistics.php
unknown
xml
341 b
malicious
1040
69bf2.Virus.exe
POST
404
172.105.27.61:80
http://ssbzmoy.biz/tudsnvrnt
US
xml
341 b
malicious
1040
69bf2.Virus.exe
POST
404
63.251.126.10:80
http://npukfztj.biz/h
US
xml
341 b
malicious
1040
69bf2.Virus.exe
POST
404
173.231.184.124:80
http://cvgrf.biz/vydqtlwxkdpnsfca
US
xml
341 b
malicious
1040
69bf2.Virus.exe
POST
404
173.231.184.124:80
http://cvgrf.biz/vydqtlwxkdpnsfca
US
xml
341 b
malicious
1040
69bf2.Virus.exe
POST
404
167.99.35.88:80
http://przvgke.biz/h
US
xml
341 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1040
69bf2.Virus.exe
212.193.30.45:80
—
—
RU
malicious
1040
69bf2.Virus.exe
104.23.99.190:443
pastebin.com
Cloudflare Inc
US
malicious
1040
69bf2.Virus.exe
45.144.225.57:80
—
—
—
malicious
1040
69bf2.Virus.exe
172.105.27.61:80
ssbzmoy.biz
—
US
malicious
1040
69bf2.Virus.exe
104.21.5.208:80
wfsdragon.ru
Cloudflare Inc
US
malicious
1040
69bf2.Virus.exe
2.56.59.42:80
—
—
—
malicious
1040
69bf2.Virus.exe
173.231.184.124:80
cvgrf.biz
Voxel Dot Net, Inc.
US
malicious
1040
69bf2.Virus.exe
63.251.126.10:80
npukfztj.biz
Voxel Dot Net, Inc.
US
malicious
1040
69bf2.Virus.exe
167.99.35.88:80
przvgke.biz
—
US
malicious
2724
alg.exe
173.231.184.124:80
cvgrf.biz
Voxel Dot Net, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
pywolwnvd.biz
  • —
malicious
ssbzmoy.biz
  • 172.105.27.61
malicious
pastebin.com
  • 104.23.99.190
  • 104.23.98.190
malicious
wfsdragon.ru
  • 104.21.5.208
  • 172.67.133.215
malicious
cvgrf.biz
  • 173.231.184.124
malicious
npukfztj.biz
  • 63.251.126.10
malicious
przvgke.biz
  • 167.99.35.88
malicious
zlenh.biz
  • 85.17.31.82
  • 85.17.31.122
  • 178.162.203.202
  • 178.162.203.211
  • 178.162.203.226
  • 178.162.217.107
  • 5.79.71.205
  • 5.79.71.225
malicious
knjghuig.biz
  • 5.79.71.205
  • 5.79.71.225
  • 85.17.31.82
  • 85.17.31.122
  • 178.162.203.202
  • 178.162.203.211
  • 178.162.203.226
  • 178.162.217.107
malicious
uhxqin.biz
  • 35.234.136.13
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1040
69bf2.Virus.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1040
69bf2.Virus.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
1040
69bf2.Virus.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
69bf2.Virus.exe