analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

PracticalMalwareAnalysis-Labs.exe

Full analysis: https://app.any.run/tasks/1fe6dbfa-903a-42f8-a2e3-6d08217381fe
Verdict: Malicious activity
Analysis date: December 18, 2018, 17:31:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5:

9D9C90870BC46AD65BAF0F3977E7590F

SHA1:

DEC5842D07BBD00EDF564FE27C14118EC9ECC77F

SHA256:

704138BEC89CF9E7F00FBCE100DBC09CF133D16DC0203806392F0E153C43C68C

SSDEEP:

24576:uxaVxr53s2QByK9VHFsZ+Ykyxm7g8LVYD/rh6m6er9wgwGe66hXS:u6QXHFsrxKY70neru/66dS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Lab21-02.exe (PID: 2208)
      • Lab19-02.exe (PID: 3368)
      • Lab01-01.exe (PID: 3292)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1596)

    • Runs injected code in another process

      • Lab21-02.exe (PID: 2208)

    • Application was injected by another process

      • explorer.exe (PID: 236)

  • SUSPICIOUS

    • Reads internet explorer settings

      • PracticalMalwareAnalysis-Labs.exe (PID: 3132)

    • Starts Internet Explorer

      • Lab19-02.exe (PID: 3368)

    • Executable content was dropped or overwritten

      • PracticalMalwareAnalysis-Labs.exe (PID: 3132)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2116)

    • Application was crashed

      • iexplore.exe (PID: 2116)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2580)

    • Changes internet zones settings

      • iexplore.exe (PID: 2116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0xb3c1
UninitializedDataSize: -
InitializedDataSize: 25600
CodeSize: 72704
LinkerVersion: 9
PEType: PE32
TimeStamp: 2012:01:09 14:44:06+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 09-Jan-2012 13:44:06
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 09-Jan-2012 13:44:06
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00011A70
0x00011C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55432
.rdata
0x00013000
0x00001C05
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.8666
.data
0x00015000
0x000156FC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.57792
.CRT
0x0002B000
0x00000010
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.213101
.rsrc
0x0002C000
0x00004110
0x00004200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.07771

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20816
1464
Latin 1 / Western European
English - United States
RT_MANIFEST
7
3.24143
556
Latin 1 / Western European
English - United States
RT_STRING
8
3.26996
974
Latin 1 / Western European
English - United States
RT_STRING
9
3.04375
530
Latin 1 / Western European
English - United States
RT_STRING
10
3.16254
776
Latin 1 / Western European
English - United States
RT_STRING
11
3.06352
380
Latin 1 / Western European
English - United States
RT_STRING
12
2.33959
102
Latin 1 / Western European
English - United States
RT_STRING
100
1.91924
20
Latin 1 / Western European
Process Default Language
RT_GROUP_ICON
101
4.19099
2998
Latin 1 / Western European
English - United States
RT_BITMAP
ASKNEXTVOL
3.42597
646
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject practicalmalwareanalysis-labs.exe searchprotocolhost.exe no specs lab01-01.exe no specs lab21-02.exe no specs explorer.exe lab19-02.exe no specs iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3132"C:\Users\admin\AppData\Local\Temp\PracticalMalwareAnalysis-Labs.exe" C:\Users\admin\AppData\Local\Temp\PracticalMalwareAnalysis-Labs.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1596"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3292"C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_1L\Lab01-01.exe" C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_1L\Lab01-01.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2208"C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_21L\Lab21-02.exe" C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_21L\Lab21-02.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
236C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3368"C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_19L\Lab19-02.exe" C:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_19L\Lab19-02.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2116"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Lab19-02.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2580"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2116 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 880
Read events
2 501
Write events
0
Delete events
0

Modification events

No data
Executable files
65
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-03.dllexecutable
MD5:BBD65FCAD68E5A3CD1457E2EE05D1F2E
SHA256:F11FA868AC3DEE1E5FBD985FE15BA6D34C7EC0ABB47BABE0D34A35514C49C86A
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-01.dllexecutable
MD5:A6FB0D8FDEA1C15AFBA7A5DDB3D2867B
SHA256:0EA89A83B84B8D20E259BACB6B0D1B176C8327F097C54749AE832981F2A0095A
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-01.sysexecutable
MD5:3D3D1A8145E3237183984FAED04E052E
SHA256:D12A2C116A12993CFCF2F432A4FE53F8F6B3686E33ED8F7E8FF4628A37BD616E
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-04.exeexecutable
MD5:56BED8249E7C2982A90E54E1E55391A2
SHA256:E2AED4398E0178670D9678961CA89A0F15A3EAC20F396BDF29DE8AC66CB853FA
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_12L\Lab12-01.exeexecutable
MD5:DAFBEA2A91F86BF5E52EFA3BAC3F1B16
SHA256:1FB3C4A9109EF171FA67BDF90E67F09EF25B5A1D401DC20DC45CFCCF1E4FBD99
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-02.inibinary
MD5:B61964305851A7AB4179067C231B4D97
SHA256:0493C7167AE07704ED41FE4D43333165F3167ACA8547B6F1D2C67592ECCC6FA2
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_13L\Lab13-01.exeexecutable
MD5:A9A2734D080E3AE0F5ADA35E878DA7C8
SHA256:71A295247BA7419F9F9DEA8098E6867182BB80F53C98EB0F59192A6557A51249
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-03.exeexecutable
MD5:F72D773F13CEB6B842A9D29C56F8880F
SHA256:D66E15EEA51EBD4BFD13F8C97646253740B1E6A99328D22232FD01AE13EF5D05
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_10L\Lab10-03.sysexecutable
MD5:CF91A08F3D7A2875D6120C16B7C55398
SHA256:59D09B747441ED35E0FC0B5B352B4C66532F1FDD4646457A5EA972F067A55B30
3132PracticalMalwareAnalysis-Labs.exeC:\Users\admin\Desktop\Practical Malware Analysis Labs\BinaryCollection\Chapter_11L\Lab11-01.exeexecutable
MD5:A9C55BB87A7C5C3C923C4FA12940E719
SHA256:57D8D248A8741176348B5D12DCF29F34C8F48EDE0CA13C30D12E5BA0384056D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PracticalMalwareAnalysis-Labs.exe