analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Duxa's PS4 patch repackager 6.15.18.exe

Full analysis: https://app.any.run/tasks/7566e742-86a5-4431-a173-4aae52411900
Verdict: Malicious activity
Analysis date: June 16, 2018, 15:42:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

7892CC956FD394DA4F49870AE3C23FFD

SHA1:

BD21E4A0C2E497F8039310862B1AF4F88443849D

SHA256:

95FEF2F75054A7831045B35058DD8EB280B49B75272C25D44BD7E2E67E865AC4

SSDEEP:

98304:VJclsqF52N2K/eP7raxmv/ieIAUIbwhqDsZZUxCkIPscB3loEGMY+R:4pF8Z+mkv/ieKIbRbxCH0cBlv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Robocopy.exe (PID: 3380)
      • Robocopy.exe (PID: 3780)
      • Robocopy.exe (PID: 4012)
      • Duxa's PS4 patch repackager 6.15.18.exe (PID: 3032)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2556)

    • Starts CMD.EXE for commands execution

      • Duxa's PS4 patch repackager 6.15.18.exe (PID: 3032)
      • cmd.exe (PID: 2556)

    • Application launched itself

      • cmd.exe (PID: 2556)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2496)

  • INFO

    • Dropped object may contain URL's

      • Duxa's PS4 patch repackager 6.15.18.exe (PID: 3032)

    • Dropped object may contain Bitcoin addresses

      • Duxa's PS4 patch repackager 6.15.18.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductName: Automated pkg repackager
LegalCopyright: Duxa (aka Chrushev)
CompanyName: -
FileDescription: PS4 update repackager (fake pkg only)
ProductVersion: 0.6.15.18
FileVersion: 0.6.15.18
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.6.15.18
FileVersionNumber: 0.6.15.18
Subsystem: Windows command line
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x651e
UninitializedDataSize: -
InitializedDataSize: 16384
CodeSize: 49152
LinkerVersion: 6
PEType: PE32
TimeStamp: 2012:11:26 20:47:21+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 26-Nov-2012 19:47:21
Detected languages:
  • English - United States
FileVersion: 0.6.15.18
ProductVersion: 0.6.15.18
FileDescription: PS4 update repackager (fake pkg only)
CompanyName: -
LegalCopyright: Duxa (aka Chrushev)
ProductName: Automated pkg repackager

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 26-Nov-2012 19:47:21
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000BE7C
0x0000C000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.50763
.rdata
0x0000D000
0x00000AE8
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.14255
.data
0x0000E000
0x00AFFF78
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.9513
.rsrc
0x00B0E000
0x00001428
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.24601

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.41409
636
Latin 1 / Western European
UNKNOWN
RT_VERSION
102
2.18548
20
Latin 1 / Western European
English - United States
RT_GROUP_ICON

Imports

KERNEL32.dll
WINMM.dll
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
39
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start duxa's ps4 patch repackager 6.15.18.exe no specs duxa's ps4 patch repackager 6.15.18.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs robocopy.exe robocopy.exe robocopy.exe robocopy.exe no specs choice.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs PhotoViewer.dll no specs

Process information

PID
CMD
Path
Indicators
Parent process
3840"C:\Users\admin\AppData\Local\Temp\Duxa's PS4 patch repackager 6.15.18.exe" C:\Users\admin\AppData\Local\Temp\Duxa's PS4 patch repackager 6.15.18.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PS4 update repackager (fake pkg only)
Exit code:
3221226540
Version:
0.6.15.18
3032"C:\Users\admin\AppData\Local\Temp\Duxa's PS4 patch repackager 6.15.18.exe" C:\Users\admin\AppData\Local\Temp\Duxa's PS4 patch repackager 6.15.18.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
PS4 update repackager (fake pkg only)
Exit code:
0
Version:
0.6.15.18
2932C:\Windows\system32\cmd.exe /c if not exist "C:\Users\admin\AppData\Local\Temp\afolder" mkdir "C:\Users\admin\AppData\Local\Temp\afolder"C:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3192C:\Windows\system32\cmd.exe /c if not exist "C:\Users\admin\AppData\Local\Temp\ztmp" mkdir "C:\Users\admin\AppData\Local\Temp\ztmp"C:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2496C:\Windows\system32\cmd.exe /c attrib +h C:\Users\admin\AppData\Local\Temp\ztmpC:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1396attrib +h C:\Users\admin\AppData\Local\Temp\ztmpC:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1348C:\Windows\system32\cmd.exe /c if exist "C:\Users\admin\AppData\Local\Temp\afolder\sc.exe" del "C:\Users\admin\AppData\Local\Temp\afolder\sc.exe"C:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
848C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3056C:\Windows\system32\cmd.exe /c if exist "C:\Users\admin\AppData\Local\Temp\afolder\trp_compare_default.css" del "C:\Users\admin\AppData\Local\Temp\afolder\trp_compare_default.css"C:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3236C:\Windows\system32\cmd.exe /c clsC:\Windows\system32\cmd.exe—Duxa's PS4 patch repackager 6.15.18.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
230
Read events
226
Write events
4
Delete events
0

Modification events

(PID) Process:(3380) Robocopy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\ResKit\Robocopy
Operation:writeName:WaitTime
Value:
30000
(PID) Process:(3380) Robocopy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\ResKit\Robocopy
Operation:writeName:RetryMax
Value:
1000000
(PID) Process:(3380) Robocopy.exeKey:HKEY_CURRENT_USER\Software\Microsoft\ResKit\Robocopy
Operation:writeName:JobDir
Value:
::
(PID) Process:—Key:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
DllHost.exe
Executable files
8
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\ztmp\tmp878.bathtml
MD5:0089DA1E6B7E90ED910E78875F4980AE
SHA256:F511F3C9239EB7E2EC42F535B66CF77F031181ECB5F17199BD731607C8F80316
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\sc.exeexecutable
MD5:2B0E372B7D2BD1D7DA721ACC5BC835FD
SHA256:32389FBD3DBFE62F140DB1EB81E8D968259CD908D66AEB7A656DE8E0A99ABF35
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\di.exeexecutable
MD5:66F80B89C95092F8A2FB65234505A5CD
SHA256:1D2A2F60416BDDEB9E4C93DA7721F9FE9CB4B7629894E7F85057C5205CB1F4B3
4012Robocopy.exeC:\Users\admin\AppData\Local\Temp\afolder\ext\sc.exeexecutable
MD5:2B0E372B7D2BD1D7DA721ACC5BC835FD
SHA256:32389FBD3DBFE62F140DB1EB81E8D968259CD908D66AEB7A656DE8E0A99ABF35
3380Robocopy.exeC:\Users\admin\AppData\Local\Temp\afolder\ext\di.exeexecutable
MD5:66F80B89C95092F8A2FB65234505A5CD
SHA256:1D2A2F60416BDDEB9E4C93DA7721F9FE9CB4B7629894E7F85057C5205CB1F4B3
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\gengp4.exeexecutable
MD5:CBBB5C7C6944F33886262D8F8C27EC97
SHA256:65042F9982E6DB4C8610E8E735CA296E685518917CB71E7DB42451B5069846E6
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\orbis-pub-cmd.exeexecutable
MD5:75CC4073EFE568E64623C3BE960B3D63
SHA256:10F39B739B9D146F3D447AE2BC3A8C66E9D76181A35413BC42C3C25CB317A864
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\ztmp\tmp6697.exetext
MD5:3C52638971EAD82B5929D605C1314EE0
SHA256:5614459EC05FDF6110FA8CE54C34E859671EEFFBA2B7BB4B1AD6C2C6706855AB
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\libatrac9.dllexecutable
MD5:C878A972781E4D5C70666C45B92A155A
SHA256:E1B1F3DB147D7996A5B1FBDDB2B7322E56F25BBF689F47C50638FD268FC1D3C7
3032Duxa's PS4 patch repackager 6.15.18.exeC:\Users\admin\AppData\Local\Temp\afolder\trp_compare_default.csstext
MD5:C81F94F97FDE3589B73F45DD8DBD6579
SHA256:F13A0E3A78EA423DD4883AA030C2E898F206EB0F08693E83A32198217253790B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Duxa's PS4 patch repackager 6.15.18.exe