File name:

SecuriteInfo.com.Variant.Babar.405080.448.25421

Full analysis: https://app.any.run/tasks/7e88a922-4f6d-475b-bc96-904e0a19a45f
Verdict: Malicious activity
Analysis date: November 12, 2023, 13:26:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EC5C248AD1A479D2B2C4F99BDD3DDD9D

SHA1:

0F23FFF0FA692014F5983332EE176394C05D6D02

SHA256:

69F82FEA3BCC030442773CA5AF5645D792CDD0114188BBB5EC5DA49BC890C948

SSDEEP:

3072:jcG6T9SmWBZA/0uUNVEk8ggggAkcEEEEkEEkkkcEEkEgAOyk8gEggT3kCHW1jOFq:jcRJSmWzEjAONwFQPu1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads the Internet Settings

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads settings of System Certificates

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Checks Windows Trust Settings

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads Internet Explorer settings

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads the computer name

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Checks proxy server information

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Variant.Babar.405080.448.25421.exe (PID: 2584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:16 06:46:07+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 40960
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x3970
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.variant.babar.405080.448.25421.exe

Process information

PID
CMD
Path
Indicators
Parent process
2584"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Babar.405080.448.25421.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.variant.babar.405080.448.25421.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
1 883
Read events
1 857
Write events
23
Delete events
3

Modification events

(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2584) SecuriteInfo.com.Variant.Babar.405080.448.25421.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E81D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E090000000100000016000000301406082B0601050507030206082B060105050703010B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
3
Suspicious files
15
Text files
142
Unknown types
0

Dropped files

PID
Process
Filename
Type
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\379G9299.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\sideTool-4ff64f1b[1].csstext
MD5:B2B2C34FBD807EB9E3F35D99E8454EBB
SHA256:3D30674AC51EDF82717AE0C511AE28960AB9748F4C58FBFC90329E4C4CE61A03
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\N9SRX851.htmhtml
MD5:00AF4B111583A939482B010384668168
SHA256:C80905F221A8E6FF7B6C6FF9A9E64FA05918BC00E07F5727CBCE43E3E651BAEC
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\374DFG7H.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\TVLY3HXQ.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\KFZQP5LK.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\YJW7EU5U.htmhtml
MD5:0D98834366F43462689B908586F182E9
SHA256:A8DFCBB3CC6343A679EF353923009122DB7D6AF60F911DE5C4B718C63C037402
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\sideTool-4ff64f1b[1].csstext
MD5:B2B2C34FBD807EB9E3F35D99E8454EBB
SHA256:3D30674AC51EDF82717AE0C511AE28960AB9748F4C58FBFC90329E4C4CE61A03
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\index-762c0b1b[1].csstext
MD5:B1C6769DC2493BA4DC97625E813805C4
SHA256:88915B40AE5E41F3CD1A16AFEA2427AD53709AE94F89236860A4D617536E7824
2584SecuriteInfo.com.Variant.Babar.405080.448.25421.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\index-ddc21dcc[1].csstext
MD5:EE4DDB0248A08E61D9A7A0B612ABC3DB
SHA256:DC87BDD8F6C8D73AAB092CE4553A3008DA006151D590620EE412E77CFD47CEC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
24
DNS requests
9
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
GET
301
103.227.121.120:80
http://yy.com/
unknown
html
178 b
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
GET
301
103.227.121.120:80
http://yy.com/
unknown
html
178 b
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
GET
301
103.227.121.120:80
http://yy.com/
unknown
html
178 b
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
GET
301
103.227.121.120:80
http://yy.com/
unknown
html
178 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
103.227.121.120:80
yy.com
CHINA UNICOM China169 Backbone
CN
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
103.227.121.120:443
yy.com
CHINA UNICOM China169 Backbone
CN
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
163.181.92.237:443
web.yystatic.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
157.148.65.35:443
mobilelivephoto.bs2dl.yy.com
China Unicom Guangdong IP network
CN
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
58.254.180.65:443
emyfs.bs2cdn.yy.com
China Unicom Guangdong IP network
CN
unknown
2584
SecuriteInfo.com.Variant.Babar.405080.448.25421.exe
101.226.28.148:443
cdn.bigda.com
China Telecom Group
CN
unknown

DNS requests

Domain
IP
Reputation
yy.com
  • 103.227.121.120
  • 221.228.79.225
  • 14.17.109.72
  • 163.177.156.228
  • 183.240.168.210
  • 120.195.158.53
whitelisted
www.yy.com
  • 103.227.121.120
  • 106.38.197.51
unknown
web.yystatic.com
  • 163.181.92.237
  • 163.181.92.238
  • 163.181.92.234
  • 163.181.92.231
  • 163.181.92.232
  • 163.181.92.236
  • 163.181.92.233
  • 163.181.92.235
unknown
emyfs.bs2cdn.yy.com
  • 58.254.180.65
unknown
mobilelivephoto.bs2dl.yy.com
  • 157.148.65.35
malicious
zonemin.bs2dl.yy.com
  • 58.254.180.65
unknown
cdn.bigda.com
  • 101.226.28.148
  • 101.226.28.183
  • 101.226.28.185
  • 101.226.28.187
  • 101.226.28.186
  • 101.226.28.188
  • 101.226.28.184
  • 101.226.28.182
unknown
hdjs.bigda.com
  • 101.226.28.187
  • 101.226.28.182
  • 101.226.28.183
  • 101.226.28.185
  • 101.226.28.184
  • 101.226.28.186
  • 101.226.28.148
  • 101.226.28.188
unknown

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Variant.Babar.405080.448.25421