File name: | file |
Full analysis: | https://app.any.run/tasks/c0157d3d-feff-46cc-88ef-bbddfb5f7d84 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 19:05:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 44085873D2D9AD0A6126F752AD80C4E3 |
SHA1: | A1B8302E4B7A65C4FD62F5F883B4884BB7AB20F9 |
SHA256: | 6B6EB4B5978054AC9EEE21AF78C11667E65AB78E5533D72DBFA420A42DDC7B40 |
SSDEEP: | 196608:91Osam/50vvgbW+iD3IBKI4pZHbzaO+in0g:3OZmh6vyWR35FZHaY0g |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2010-Nov-18 16:27:35 |
Detected languages: |
|
CompanyName: | Igor Pavlov |
FileDescription: | 7z Setup SFX |
FileVersion: | 9.20 |
InternalName: | 7zS.sfx |
LegalCopyright: | Copyright (c) 1999-2010 Igor Pavlov |
OriginalFilename: | 7zS.sfx.exe |
ProductName: | 7-Zip |
ProductVersion: | 9.20 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 232 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2010-Nov-18 16:27:35 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 104938 | 104960 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.60849 |
.rdata | 110592 | 17556 | 17920 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.36802 |
.data | 131072 | 23112 | 12800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.37054 |
.sxdata | 155648 | 4 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 159744 | 2656 | 3072 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.30196 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.75404 | 744 | UNKNOWN | English - United States | RT_ICON |
2 | 3.18403 | 296 | UNKNOWN | English - United States | RT_ICON |
5 | 1.43775 | 52 | UNKNOWN | English - United States | RT_STRING |
500 | 3.09294 | 184 | UNKNOWN | English - United States | RT_DIALOG |
1 (#2) | 2.78284 | 148 | UNKNOWN | English - United States | RT_STRING |
1 (#3) | 2.37086 | 34 | UNKNOWN | English - United States | RT_GROUP_ICON |
1 (#4) | 3.44049 | 700 | UNKNOWN | English - United States | RT_VERSION |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3516 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7z Setup SFX Exit code: 3221226540 Version: 9.20 Modules
| |||||||||||||||
2104 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | Explorer.EXE | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Exit code: 0 Version: 9.20 Modules
| |||||||||||||||
1988 | .\Install.exe | C:\Users\admin\AppData\Local\Temp\7zSECC3.tmp\Install.exe | — | file.exe | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Exit code: 0 Version: 9.20 Modules
| |||||||||||||||
3416 | .\Install.exe /S /site_id "525403" | C:\Users\admin\AppData\Local\Temp\7zSF02E.tmp\Install.exe | — | Install.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
1120 | "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0&" | C:\Windows\System32\forfiles.exe | — | Install.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3396 | "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0&" | C:\Windows\System32\forfiles.exe | — | Install.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3360 | /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0& | C:\Windows\System32\cmd.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2636 | REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 | c:\windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1936 | /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0& | C:\Windows\System32\cmd.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3688 | REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 | c:\windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3416) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3416) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3416) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3416) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2636) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions |
Operation: | write | Name: | exe |
Value: 0 | |||
(PID) Process: | (3688) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet |
Operation: | write | Name: | SpyNetReporting |
Value: 0 | |||
(PID) Process: | (2752) powershell.EXE | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2752) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2752) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2752) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2752 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YHANP67RUFCO6SS0258D.temp | binary | |
MD5:DF79ECEE84239B6ED67F46A01767A749 | SHA256:4A338A22ACED5DEE19ECF80262B0C994EBC9C68F7D89629C2EE73C9FE6EEC10E | |||
3416 | Install.exe | C:\Users\admin\AppData\Local\Temp\NSAYtBReBeNFnznQr\zYSblTdVstRcyqP\HqbAWMO.exe | executable | |
MD5:A642CAB9B19C6F58CFBC6A22C2CD6C11 | SHA256:38E5CA7D40BD3598246E945F2CAA0E9D37B5929AB132F2CD67DF29B4C4D05D6B | |||
2104 | file.exe | C:\Users\admin\AppData\Local\Temp\7zSECC3.tmp\__data__\config.txt | binary | |
MD5:F3026D4D8B6B2F7DB4D82F0668AAEFB2 | SHA256:1937867538D805678EF751B941A80563EEDFA220B2C94EA378245A8E86126CE7 | |||
1408 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1231c6.TMP | binary | |
MD5:DF79ECEE84239B6ED67F46A01767A749 | SHA256:4A338A22ACED5DEE19ECF80262B0C994EBC9C68F7D89629C2EE73C9FE6EEC10E | |||
2752 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:DF79ECEE84239B6ED67F46A01767A749 | SHA256:4A338A22ACED5DEE19ECF80262B0C994EBC9C68F7D89629C2EE73C9FE6EEC10E | |||
2776 | HqbAWMO.exe | C:\Windows\Temp\WtMYTPIbSwjziXOH\cWBmzeye\yNytMRqCHQyYntPX.wsf | binary | |
MD5:A9C8F581F30FBD74DEEC41FD9F470D71 | SHA256:A00BACF45F6CEE0C2FCF498C16C69E0DE75EB8C957F4F27A3688516AC68DBBBA | |||
2776 | HqbAWMO.exe | C:\Windows\System32\GroupPolicy\Machine\registry.pol | binary | |
MD5:3ED0466983586B162999C447985E66DB | SHA256:65D8CF7CE5AAAD658AF22F4941BDF632C2E8AC5490F8B6CB52ECB7BB6BE5A326 | |||
1988 | Install.exe | C:\Users\admin\AppData\Local\Temp\7zSF02E.tmp\Install.exe | executable | |
MD5:A642CAB9B19C6F58CFBC6A22C2CD6C11 | SHA256:38E5CA7D40BD3598246E945F2CAA0E9D37B5929AB132F2CD67DF29B4C4D05D6B | |||
2752 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF110abb.TMP | binary | |
MD5:CCFCF369F751CE8DA0370D84E52A7EED | SHA256:53922490C3F5A04667EC3605A01AF2A4F4F265782D1BCA519F63ACAD413F2ED9 | |||
2104 | file.exe | C:\Users\admin\AppData\Local\Temp\7zSECC3.tmp\Install.exe | executable | |
MD5:4538FAD491D85E70AB95147325790664 | SHA256:0DF919CAC391DA767D735F3110D2801E7B07940278951BAEA024D4FAD0B171F0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2452 | gyDVofW.exe | GET | 200 | 184.25.51.82:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgO3KnkYkYvzjMTY%2BDHZyvRw3Q%3D%3D | US | der | 503 b | shared |
2452 | gyDVofW.exe | GET | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
2452 | gyDVofW.exe | GET | 200 | 8.238.30.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5d9d45c540f279df | US | compressed | 61.4 Kb | whitelisted |
2452 | gyDVofW.exe | GET | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDuZCz4OZecyRJCVianxG0K | US | der | 472 b | whitelisted |
2452 | gyDVofW.exe | GET | 200 | 8.238.30.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3c6e9b20dbc99968 | US | compressed | 4.70 Kb | whitelisted |
2452 | gyDVofW.exe | GET | 200 | 23.52.55.67:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
2452 | gyDVofW.exe | GET | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDreCS75DAIaRKqvCi%2FvL9c | US | der | 472 b | whitelisted |
1500 | rundll32.EXE | POST | 200 | 52.27.164.166:80 | http://api2.check-data.xyz/api2/google_api_ifi | US | — | — | malicious |
2452 | gyDVofW.exe | GET | 200 | 142.250.186.163:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2452 | gyDVofW.exe | 3.80.150.121:443 | service-domain.xyz | AMAZON-AES | US | suspicious |
2452 | gyDVofW.exe | 142.250.185.78:443 | clients2.google.com | GOOGLE | US | whitelisted |
2452 | gyDVofW.exe | 142.250.186.163:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
2452 | gyDVofW.exe | 23.52.55.67:80 | x1.c.lencr.org | AKAMAI-AS | NL | unknown |
2452 | gyDVofW.exe | 142.250.186.170:443 | www.googleapis.com | GOOGLE | US | whitelisted |
2452 | gyDVofW.exe | 8.238.30.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
2452 | gyDVofW.exe | 184.25.51.82:80 | r3.o.lencr.org | Akamai International B.V. | DE | unknown |
1500 | rundll32.EXE | 52.27.164.166:80 | api2.check-data.xyz | AMAZON-02 | US | suspicious |
Domain | IP | Reputation |
---|---|---|
service-domain.xyz |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
www.googleapis.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
clients2.google.com |
| whitelisted |
api2.check-data.xyz |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2452 | gyDVofW.exe | Potentially Bad Traffic | ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz) |
1500 | rundll32.EXE | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |