File name: | malashop.exe |
Full analysis: | https://app.any.run/tasks/393c10ed-9b3c-4eb4-80d7-dca2705df3de |
Verdict: | Malicious activity |
Analysis date: | July 18, 2019, 06:18:17 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 099FAA9A4B9CA4C6D7A266BB3302C4FF |
SHA1: | 90ECBF5A42EDCE532D0F31CF6BB8FD5CBF9D3E5A |
SHA256: | 78B92292A30DA36A7367B084F6971531B1196CCE11C9726F23ABE993580EE4BB |
SSDEEP: | 6144:ZK/SHvClCGcVUrSdKUpiD4/jqKwvBcQJ1VYYleBXA:ZK/DNd2tpiD4ep5dJ1ghA |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:07:18 01:20:40+02:00 |
PEType: | PE32 |
LinkerVersion: | 12 |
CodeSize: | 114176 |
InitializedDataSize: | 180224 |
UninitializedDataSize: | - |
EntryPoint: | 0xc0a0 |
OSVersion: | 6 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.3.7.5 |
ProductVersionNumber: | 1.3.7.5 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
PrivateBuild: | 1.3.7.5 |
Languages: | English |
LegalTrademarks: | Copyright (c) |
CompanyName: | Sony Creative Software Inc |
FileDescription: | Which Expression |
Comments: | Which Expression |
OriginalFileName: | Wurst |
AssemblyVersion: | 1.3.7.5 |
FileVersion: | 1.3.7.5 |
LegalCopyright: | Copyright (c) |
InternalName: | Wurst |
ProductName: | Wurst |
ProductVersion: | 1.3.7.5 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 17-Jul-2019 23:20:40 |
Detected languages: |
|
PrivateBuild: | 1.3.7.5 |
Languages: | English |
LegalTrademarks: | Copyright (c) |
CompanyName: | Sony Creative Software Inc |
FileDescription: | Which Expression |
Comments: | Which Expression |
OriginalFilename: | Wurst |
Assembly Version: | 1.3.7.5 |
FileVersion: | 1.3.7.5 |
LegalCopyright: | Copyright (c) |
InternalName: | Wurst |
ProductName: | Wurst |
ProductVersion: | 1.3.7.5 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 17-Jul-2019 23:20:40 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0001BD74 | 0x0001BE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62583 |
.rdata | 0x0001D000 | 0x0000BBD0 | 0x0000BC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.7398 |
.data | 0x00029000 | 0x00006C20 | 0x00003E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.4843 |
.rsrc | 0x00030000 | 0x0001C524 | 0x0001C600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.57298 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.07149 | 536 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 6.56741 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 6.67268 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
484 | 7.84945 | 1186 | Latin 1 / Western European | English - United States | UNKNOWN |
485 | 7.60916 | 682 | Latin 1 / Western European | English - United States | UNKNOWN |
486 | 7.56754 | 553 | Latin 1 / Western European | English - United States | UNKNOWN |
705 | 7.85676 | 1184 | Latin 1 / Western European | English - United States | UNKNOWN |
706 | 7.57898 | 739 | Latin 1 / Western European | English - United States | UNKNOWN |
707 | 7.76341 | 770 | Latin 1 / Western European | English - United States | UNKNOWN |
982 | 3.13359 | 744 | Latin 1 / Western European | English - United States | RT_STRING |
AVIFIL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
ODBC32.dll |
SETUPAPI.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
USP10.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3580 | "C:\Users\admin\Desktop\malashop.exe" | C:\Users\admin\Desktop\malashop.exe | explorer.exe | |
User: admin Company: Sony Creative Software Inc Integrity Level: MEDIUM Description: Which Expression Exit code: 0 Version: 1.3.7.5 | ||||
2724 | "windanr.exe" | C:\Windows\system32\windanr.exe | — | qemu-ga.exe |
User: admin Integrity Level: MEDIUM | ||||
2872 | C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3176 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10009_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10009 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3124 | C:\Windows\system32\AUDIODG.EXE 0x4f8 | C:\Windows\system32\AUDIODG.EXE | — | svchost.exe |
User: LOCAL SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Audio Device Graph Isolation Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2916 | C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2344 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe10_ Global\UsGthrCtrlFltPipeMssGthrPipe10 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3856 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-100011_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-100011 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3892 | "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520 | C:\Windows\system32\SearchFilterHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Filter Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
652 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe12_ Global\UsGthrCtrlFltPipeMssGthrPipe12 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | APPSTARTING |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | ARROW |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | CROSS |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | HAND |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | HELP |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | IBEAM |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | NO |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | SIZEALL |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | SIZENESW |
Value: %SystemRoot%\cursors\clearcur.cur | |||
(PID) Process: | (2724) windanr.exe | Key: | HKEY_CURRENT_USER\Control Panel\Cursors |
Operation: | write | Name: | SIZENS |
Value: %SystemRoot%\cursors\clearcur.cur |
PID | Process | Filename | Type | |
---|---|---|---|---|
3176 | SearchProtocolHost.exe | C:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp | — | |
MD5:— | SHA256:— | |||
3856 | SearchProtocolHost.exe | C:\Users\admin\Documents\Outlook Files\~Outlook Data File - NoMail.pst.tmp | — | |
MD5:— | SHA256:— | |||
3856 | SearchProtocolHost.exe | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | pst | |
MD5:173CF344E6AAAA96D9FC7B56A1722A02 | SHA256:4D012F6848953B02BC558453D88DC4043756EA8CB6E01B67F92AA46B53E43D4D | |||
3176 | SearchProtocolHost.exe | C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst | pst | |
MD5:5EDBCAFC1824BF820830D957943F8C60 | SHA256:0C3F242F934300B81189F14E3F775AE3180CE572F5019D87362EF26AAD089B70 | |||
3580 | malashop.exe | C:\Users\admin\AppData\Local\Temp\6B79.tmp | executable | |
MD5:ED60C95C805DBAEE92C90C3AB930085A | SHA256:D35574D2CC42B4EDBF217A86639864422FBE02443250A36EB2CD11B22F165C39 |
Process | Message |
---|---|
mmc.exe | Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|