File name:

a

Full analysis: https://app.any.run/tasks/a02ff378-693a-437f-a22d-0a0fce9ba9a5
Verdict: Malicious activity
Analysis date: April 21, 2024, 08:24:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

87D94635372B874F18ACB3AF7C340357

SHA1:

8CC5DF68540F4E3E9DD417B1BE803221D1A76778

SHA256:

88C10674BB6A53791BFE08497948699BF57EA9980A878A3A5FC1AFB160D1D234

SSDEEP:

24576:mjCvnkFJUlhVrFu4eXubuisj5m7oLMFHwb:mUebH9m7jH0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • a.exe (PID: 3416)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • a.exe (PID: 3416)

    • Reads the Internet Settings

      • a.exe (PID: 3416)

    • Executable content was dropped or overwritten

      • a.exe (PID: 3416)

  • INFO

    • Checks supported languages

      • a.exe (PID: 3416)

    • Reads product name

      • a.exe (PID: 3416)

    • Reads Environment values

      • a.exe (PID: 3416)

    • Reads the computer name

      • a.exe (PID: 3416)

    • Checks proxy server information

      • a.exe (PID: 3416)

    • Creates files or folders in the user directory

      • a.exe (PID: 3416)

    • Reads the machine GUID from the registry

      • a.exe (PID: 3416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:13 09:20:42+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.35
CodeSize: 266240
InitializedDataSize: 1172992
UninitializedDataSize: -
EntryPoint: 0x1bae5
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2021.3.12.62403
ProductVersionNumber: 2021.3.12.62403
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Unity Technologies ApS
FileDescription: Telegram@quzimingyue
FileVersion: 2021.3.12.9106371
InternalName: UnityPlayer
LegalCopyright: (c) 2022 Unity Technologies ApS. All rights reserved.
ProductName: Unity
ProductVersion: 2021.3.12f1 (8af3c3e441b1)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start a.exe

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Users\admin\AppData\Local\Temp\a.exe" C:\Users\admin\AppData\Local\Temp\a.exe
explorer.exe
User:
admin
Company:
Unity Technologies ApS
Integrity Level:
MEDIUM
Description:
Telegram@quzimingyue
Version:
2021.3.12.9106371
Modules
Images
c:\users\admin\appdata\local\temp\a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
724
Read events
698
Write events
20
Delete events
6

Modification events

(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3416) a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3416a.exeC:\Users\admin\AppData\Roaming\gcloud.exeexecutable
MD5:87D94635372B874F18ACB3AF7C340357
SHA256:88C10674BB6A53791BFE08497948699BF57EA9980A878A3A5FC1AFB160D1D234
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
25
DNS requests
2
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
3416
a.exe
POST
403
120.26.240.121:80
http://alibababackupcloud.com/spyder/smile.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3416
a.exe
120.26.240.121:80
alibababackupcloud.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown

DNS requests

Domain
IP
Reputation
alibababackupcloud.com
  • 120.26.240.121
unknown

Threats

PID
Process
Class
Message
3416
a.exe
Malware Command and Control Activity Detected
ET MALWARE WarHawk/Spyder Activity (Deploy)
No debug info