analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

msc.exe

Full analysis: https://app.any.run/tasks/2ef04e58-bf11-45a7-a6f4-b3d35f7fbdca
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 01:38:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6E29D31DF34039682CC74D6667281077

SHA1:

8754B67952B2B7867195CC83DE08783E31C0B632

SHA256:

8C275B3D4F5A1F30D54AE7370F24F3D7CB0569AA0260B96DA5018A58AA490F37

SSDEEP:

24576:nnzABXFT5Nkp28OTkjPz+ynIAtuf+zsQ5jhozX3XSQ54Gli7vateD1Ax:nzukUZwb+ynttuf+zsAoB4ai7vUepA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MakeLink.exe (PID: 3516)
      • msclientpe.exe (PID: 1256)
      • runfile.exe (PID: 3044)
      • myconnectionpc[1].exe (PID: 2352)
      • MakeLink.exe (PID: 2256)
      • msclientae.exe (PID: 3368)
      • runfile.exe (PID: 880)

    • Loads dropped or rewritten executable

      • java.exe (PID: 2780)
      • java.exe (PID: 588)
      • java.exe (PID: 2664)
      • java.exe (PID: 2468)
      • java.exe (PID: 2488)
      • java.exe (PID: 2176)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2328)

  • SUSPICIOUS

    • Creates files in the program directory

      • java.exe (PID: 2780)
      • MakeLink.exe (PID: 3516)
      • MakeLink.exe (PID: 2256)
      • java.exe (PID: 2664)

    • Executable content was dropped or overwritten

      • java.exe (PID: 2312)
      • java.exe (PID: 2616)
      • java.exe (PID: 2780)
      • iexplore.exe (PID: 2328)
      • java.exe (PID: 2664)
      • java.exe (PID: 3648)
      • java.exe (PID: 280)

    • Creates a software uninstall entry

      • java.exe (PID: 2780)
      • java.exe (PID: 2664)

    • Starts Internet Explorer

      • java.exe (PID: 2468)

    • Uses IPCONFIG.EXE to discover IP address

      • java.exe (PID: 2488)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2940)

    • Application launched itself

      • iexplore.exe (PID: 2940)

    • Creates files in the user directory

      • iexplore.exe (PID: 2328)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2328)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x26c8
UninitializedDataSize: -
InitializedDataSize: 5632
CodeSize: 6656
LinkerVersion: 6
PEType: PE32
TimeStamp: 2005:12:19 19:55:35+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Dec-2005 18:55:35
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 19-Dec-2005 18:55:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000185C
0x00001A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.99769
.rdata
0x00003000
0x0000062A
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.11709
.data
0x00004000
0x000005A4
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.36038
.rsrc
0x00005000
0x00000608
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.97556

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.81202
546
Latin 1 / Western European
English - United States
RT_MANIFEST
234
2.16096
20
Latin 1 / Western European
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
22
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start msc.exe no specs msc.exe java.exe makelink.exe no specs runfile.exe no specs java.exe java.exe no specs msclientpe.exe no specs java.exe java.exe no specs iexplore.exe iexplore.exe myconnectionpc[1].exe no specs java.exe makelink.exe no specs runfile.exe no specs java.exe java.exe no specs msclientae.exe no specs java.exe java.exe ipconfig.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2992"C:\Users\admin\AppData\Local\Temp\msc.exe" C:\Users\admin\AppData\Local\Temp\msc.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
352"C:\Users\admin\AppData\Local\Temp\msc.exe" C:\Users\admin\AppData\Local\Temp\msc.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
2780java -mx256m jexepackboot ER "C:\Users\admin\AppData\Local\Temp\msc.exe" "C:\Users\admin\AppData\Local\Temp\X433160" C:\ProgramData\Oracle\Java\javapath\java.exe
msc.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
3516"C:\Users\admin\AppData\Local\Temp\X433160\MakeLink" C:\Users\admin\AppData\Local\Temp\X433160\makelinks.txtC:\Users\admin\AppData\Local\Temp\X433160\MakeLink.exe—java.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3044"C:\Program Files\MyConnection PC Lite Edition\runfile.exe" -Q* /installC:\Program Files\MyConnection PC Lite Edition\runfile.exe—java.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2616java -mx256m jexepackboot E "C:\Program Files\MyConnection PC Lite Edition\runfile.exe" "C:\Users\admin\AppData\Local\Temp\X438BE4" "/install"C:\ProgramData\Oracle\Java\javapath\java.exe
runfile.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
12345
Version:
8.0.920.14
588java -mx256m jexepackboot R "C:\Program Files\MyConnection PC Lite Edition\runfile.exe" "C:\Users\admin\AppData\Local\Temp\X438BE4" "/install"C:\ProgramData\Oracle\Java\javapath\java.exe—runfile.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
1256"C:\Program Files\MyConnection PC Lite Edition\msclientpe.exe" C:\Program Files\MyConnection PC Lite Edition\msclientpe.exe—java.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2312java -mx256m jexepackboot E "C:\Program Files\MyConnection PC Lite Edition\msclientpe.exe" "C:\Users\admin\AppData\Local\Temp\X4394E8" C:\ProgramData\Oracle\Java\javapath\java.exe
msclientpe.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
12345
Version:
8.0.920.14
2468java -mx256m jexepackboot R "C:\Program Files\MyConnection PC Lite Edition\msclientpe.exe" "C:\Users\admin\AppData\Local\Temp\X4394E8" C:\ProgramData\Oracle\Java\javapath\java.exe—msclientpe.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Total events
1 219
Read events
1 130
Write events
0
Delete events
0

Modification events

No data
Executable files
21
Suspicious files
7
Text files
236
Unknown types
25

Dropped files

PID
Process
Filename
Type
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\box.gifimage
MD5:23D45C4644BD54E332AD16CFBE46965C
SHA256:AC3149104B576BE880D22D3D6C8C557DD754580366882F58B5BF56BB7C074A9C
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\back.gifimage
MD5:32A00E6F98D5E4329E3751009E0A173D
SHA256:BA55AED9E958163EF7FA7D5BD69F129F0ACFA4C970545BB36A19719AE1CE6163
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\bighelp.pngimage
MD5:6FABD0B73AF26AB1A3495802D8E3988D
SHA256:40488AFBF88D461A0B8373AA75EED802ED00A85A95FD7DB5080B3A65BE6B373C
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\boxadv.gifimage
MD5:BC3BFDB8B52BE8EEBDF1A2D7D537ACD4
SHA256:DBB7B594A4A3B6901189F8DF6DC6AE116F6F913A1082331E34CEAEE0DCCBF0CD
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\capspeed.pngimage
MD5:B475052D529B4362C014AD3CDEA2A83C
SHA256:D221B5C0B8522F3E2B9DF0C520E82A2324744615187E1D888671074C1E3F4DAF
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\boxbplus.gifimage
MD5:FCED62ADA3316A19D147FA4ABE4D3B25
SHA256:473F86D0DBAF232150053E1129B066F525B556296DB7B2CD07C0DAA8227733F4
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\packlist.txttext
MD5:AB73B8829C8EB0ADC6776DEFA5A39832
SHA256:E0C2BD0CF1FDAF2B126CBB18247F22C009EB200729E8E0162A5BA286E012DBB0
2780java.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:CC3AE79ABA6ECF64927D4ED615D8A177
SHA256:B12F6E39E1B3133CAB5ADD0A26D17837B02566DC38969A71BE82FCF0BA07DFFE
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\src\images\boxvoip.gifimage
MD5:B91C6DAAF5FFEE60D6F18573F811F1FA
SHA256:C8A68EDF94448F8DCDEF13A3ADB3D672B8CE85CBDDC534D16B76A03049998DB6
2780java.exeC:\Users\admin\AppData\Local\Temp\X433160\install.initext
MD5:360E4C1903B6A54D99D652E94938CA4D
SHA256:EEEB31DFBE8EA949D3FEF85C143DBFB9579177C10E0D34F2DD15E601C5C5F60A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
15
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/gcss/js/cr.js
US
text
161 b
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/test/pagebg.gif
US
image
1.22 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/gimages/logo.gif
US
image
6.62 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/gcss/styles_mcs2.css
US
text
8.55 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/mainpageimage.png
US
image
21.3 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/titlebg/mainbg.png
US
image
2.32 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/test/bordertopleft.gif
US
image
870 b
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/test/leftborder.gif
US
image
812 b
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/js/quicklinks.js
US
html
14.3 Kb
suspicious
2328
iexplore.exe
GET
200
38.100.141.76:80
http://www.myconnectionpc.com/images/test/bordertopright.gif
US
image
875 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2940
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2328
iexplore.exe
38.96.140.83:80
download.visualware.com
Cogent Communications
US
suspicious
2488
java.exe
38.100.141.80:80
dresdemo.visualware.com
Cogent Communications
US
malicious
2488
java.exe
38.100.141.110:80
update.visualware.com
Cogent Communications
US
suspicious
2328
iexplore.exe
38.100.141.76:80
www.myconnectionpc.com
Cogent Communications
US
suspicious
2328
iexplore.exe
38.100.141.80:80
dresdemo.visualware.com
Cogent Communications
US
malicious
2488
java.exe
38.100.141.75:80
secure.visualware.com
Cogent Communications
US
unknown
2328
iexplore.exe
52.216.138.251:80
twitter-badges.s3.amazonaws.com
Amazon.com, Inc.
US
shared

DNS requests

Domain
IP
Reputation
www.myconnectionpc.com
  • 38.100.141.76
suspicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
twitter-badges.s3.amazonaws.com
  • 52.216.138.251
shared
dresdemo.visualware.com
  • 38.100.141.76
  • 38.100.141.80
malicious
www.visualware.com
  • 38.100.141.80
  • 38.100.141.76
malicious
download.visualware.com
  • 38.96.140.83
suspicious
www.myspeed.com
  • 38.100.141.80
malicious
update.visualware.com
  • 38.100.141.110
suspicious
secure.visualware.com
  • 38.100.141.75
suspicious
sUMQVzV3NqeAnt2gsW41Ev4JvY2wEKYgR3CmUixFRzp.1S9MpZEXVPUdUsu613LyHwqUQtNBA3eUvbgB1uIffpU.kD2OPMuYYDtk1YsD2VhSG5MK5QZYK3RJ71i9TXThunA.LiveUpdate.crm.visualware.com
  • 92.180.2.0
unknown

Threats

PID
Process
Class
Message
2328
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
msc.exe