| download: | AutoUpdate.exe |
| Full analysis: | https://app.any.run/tasks/4504db6c-9ec5-487b-897c-ee6bb25290ae |
| Verdict: | No threats detected |
| Analysis date: | November 15, 2019, 01:11:53 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 80CCB719782BA5C3A4CC96C5F049C993 |
| SHA1: | 2199FAD28997591AB42BA1A9A4133BA91AD26C29 |
| SHA256: | 8B4879461AADAD4FD0F9617C8212652D9C44B9CA8234611F853EC6C1B9FA40E6 |
| SSDEEP: | 24576:ENrBkdjLOKnN8LLOQqrHrKgE1WHQxyLLF:ETkdjiKTHrKvWwG |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the user directory
- AutoUpdate.exe (PID: 3708)
Creates files in the driver directory
- AutoUpdate.exe (PID: 3708)
Creates files in the Windows directory
- AutoUpdate.exe (PID: 3708)
Reads internet explorer settings
- AutoUpdate.exe (PID: 3708)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (41) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (36.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.6) |
| .exe | | | Win32 Executable (generic) (5.9) |
| .exe | | | Win16/32 Executable Delphi generic (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:05:21 10:29:58+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 142336 |
| InitializedDataSize: | 917504 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x10a00a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | AutoUpdate Pro |
| CompanyName: | Liên hệ 01667662226 để mua AutoUpdate Pro |
| FileDescription: | AutoUpdate Pro |
| FileVersion: | 1.0.0.0 |
| InternalName: | AutoUpdate.exe |
| LegalCopyright: | Copyright © Nguyễn Bình 2018 |
| LegalTrademarks: | AutoUpdate Pro |
| OriginalFileName: | AutoUpdate.exe |
| ProductName: | Liên hệ 01667662226 để mua AutoUpdate Pro |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 21-May-2018 08:29:58 |
| Comments: | AutoUpdate Pro |
| CompanyName: | Liên hệ 01667662226 để mua AutoUpdate Pro |
| FileDescription: | AutoUpdate Pro |
| FileVersion: | 1.0.0.0 |
| InternalName: | AutoUpdate.exe |
| LegalCopyright: | Copyright © Nguyễn Bình 2018 |
| LegalTrademarks: | AutoUpdate Pro |
| OriginalFilename: | AutoUpdate.exe |
| ProductName: | Liên hệ 01667662226 để mua AutoUpdate Pro |
| ProductVersion: | 1.0.0.0 |
| Assembly Version: | 1.0.0.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 21-May-2018 08:29:58 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
%\x05eF\x14d-@X\xc4\x0d | 0x00002000 | 0x000DC458 | 0x000DC600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.99978 |
.text | 0x000E0000 | 0x000229F0 | 0x00022A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.54672 |
.rsrc | 0x00104000 | 0x000037B0 | 0x00003800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.33083 |
.reloc | 0x00108000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.0980042 |
0x0010A000 | 0x00000010 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0.142636 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00567 | 3251 | UNKNOWN | UNKNOWN | RT_MANIFEST |
32512 | 1.86096 | 20 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
Imports
mscoree.dll |
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1504 | "C:\Users\admin\AppData\Local\Temp\AutoUpdate.exe" | C:\Users\admin\AppData\Local\Temp\AutoUpdate.exe | — | explorer.exe | |||||||||||
User: admin Company: Liên hệ 01667662226 để mua AutoUpdate Pro Integrity Level: MEDIUM Description: AutoUpdate Pro Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3708 | "C:\Users\admin\AppData\Local\Temp\AutoUpdate.exe" | C:\Users\admin\AppData\Local\Temp\AutoUpdate.exe | explorer.exe | ||||||||||||
User: admin Company: Liên hệ 01667662226 để mua AutoUpdate Pro Integrity Level: HIGH Description: AutoUpdate Pro Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
115
Read events
96
Write events
19
Delete events
0
Modification events
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (3708) AutoUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\AutoUpdate_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
0
Suspicious files
0
Text files
8
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\httpErrorPagesScripts[1] | text | |
MD5:E7CA76A3C9EE0564471671D500E3F0F3 | SHA256:58268CA71A28973B756A48BBD7C9DC2F6B87B62AE343E582CE067C725275B63C | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\errorPageStrings[1] | text | |
MD5:1A0563F7FB85A678771450B131ED66FD | SHA256:EB5678DE9D8F29CA6893D4E6CA79BD5AB4F312813820FE4997B009A2B1A1654C | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\navcancl[1] | html | |
MD5:4BCFE9F8DB04948CDDB5E31FE6A7F984 | SHA256:BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228 | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\background_gradient[1] | image | |
MD5:20F0110ED5E4E0D5384A496E4880139B | SHA256:1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B | |||
| 3708 | AutoUpdate.exe | C:\Windows\System32\drivers\etc\hosts.ics | text | |
MD5:C734179B34D4D1F1EC7B70CD87D2051C | SHA256:C7FDD607068CD3915D9D55E413444DA414AE6EA6D72BCA9C797DEF05CCFB15FB | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\info_48[1] | image | |
MD5:49E0EF03E74704089A60C437085DB89E | SHA256:CAA140523BA00994536B33618654E379216261BABAAE726164A0F74157BB11FF | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\bullet[1] | image | |
MD5:0C4C086DD852704E8EEB8FF83E3B73D1 | SHA256:1CB3B6EA56C5B5DECF5E1D487AD51DBB2F62E6A6C78F23C1C81FDA1B64F8DB16 | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Temp\Vn.fon | fon | |
MD5:5BCB1D1F776FDB4C5CE1E9840B8B5EA0 | SHA256:C8CF8135C35F2FC8D8BEF39F3C9B6ABF7455119663BAEF74ACB4C99B2A4B3562 | |||
| 3708 | AutoUpdate.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\ErrorPageTemplate[1] | text | |
MD5:F4FE1CB77E758E1BA56B8A8EC20417C5 | SHA256:8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
4
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3708 | AutoUpdate.exe | GET | — | 103.127.196.201:80 | http://s2lol.com/ | unknown | — | — | malicious |
3708 | AutoUpdate.exe | GET | 200 | 103.127.196.201:80 | http://s2lol.com/update/volamtuyenhoang5/checkupdate.php | unknown | text | 32 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3708 | AutoUpdate.exe | 103.127.196.201:80 | s2lol.com | — | — | unknown |
3708 | AutoUpdate.exe | 103.127.196.151:443 | www.x2vn.com | — | — | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
s2lol.com |
| malicious |
huyenthoaivolam.com.vn |
| unknown |
www.x2vn.com |
| suspicious |
up.huyenthoaivolam.com.vn |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3708 | AutoUpdate.exe | Misc activity | SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7) |