File name:

9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a

Full analysis: https://app.any.run/tasks/01505e68-cd6a-499b-b71c-ee2bd06a2eb8
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: March 14, 2019, 14:34:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
adload
loader
trojan
pup
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

02FE662581E09DB00DD9C0EA13C3503B

SHA1:

02E1DBA03C6FBD245A348755A52AE09D7CA1306F

SHA256:

9B0AD91A9C56BAD5C44512D7B5EF53CC0F7C6192693BC2BDFA70DD18E4F37C3A

SSDEEP:

98304:mnswUuUlNjtogxnjcomn7kbH201GSPWta7t:ulgZcoCkbH2eV8ap

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes settings of System certificates

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
    • ADLOAD was detected

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
    • Downloads executable files from the Internet

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
    • Connects to CnC server

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
    • Loads dropped or rewritten executable

      • installer_campaign_14978.exe (PID: 3908)
      • 66CA46D1-5E6D-49AD-AED4-14B3932E7259.exe (PID: 3124)
      • mweshield.exe (PID: 2788)
    • Changes the autorun value in the registry

      • CoreTempApp.exe (PID: 2972)
      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
    • Application was dropped or rewritten from another process

      • installer_campaign_14978.exe (PID: 3908)
      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
      • 66CA46D1-5E6D-49AD-AED4-14B3932E7259.exe (PID: 3124)
      • CoreTempApp.exe (PID: 2972)
      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
      • CoreTempApp.exe (PID: 2932)
      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.exe (PID: 2760)
      • smappscontroller.exe (PID: 2120)
      • mweshield.exe (PID: 2788)
      • mweshieldup.exe (PID: 2144)
    • Uses Task Scheduler to run other applications

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2112)
      • schtasks.exe (PID: 2328)
      • schtasks.exe (PID: 2388)
    • MAILRU was detected

      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
  • SUSPICIOUS

    • Changes tracing settings of the file or console

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
    • Executable content was dropped or overwritten

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
      • installer_campaign_14978.exe (PID: 3908)
      • 66CA46D1-5E6D-49AD-AED4-14B3932E7259.exe (PID: 3124)
      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.exe (PID: 2760)
      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
    • Creates files in the user directory

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
      • installer_campaign_14978.exe (PID: 3908)
      • 66CA46D1-5E6D-49AD-AED4-14B3932E7259.exe (PID: 3124)
      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Starts Internet Explorer

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
      • CoreTempApp.exe (PID: 2972)
    • Adds / modifies Windows certificates

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
    • Creates files in the program directory

      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
    • Searches for installed software

      • 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe (PID: 4088)
      • smappscontroller.exe (PID: 2120)
    • Creates a software uninstall entry

      • installer_campaign_14978.exe (PID: 3908)
      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
    • Reads the cookies of Google Chrome

      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
    • Reads the cookies of Mozilla Firefox

      • 1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe (PID: 2280)
    • Reads Windows owner or organization settings

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Reads the Windows organization settings

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Uses TASKKILL.EXE to kill process

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Creates files in the Windows directory

      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
    • Creates files in the driver directory

      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
    • Creates or modifies windows services

      • 773BF49F-351B-43FF-9FE5-3DA329FB098D.exe (PID: 3804)
  • INFO

    • Application launched itself

      • iexplore.exe (PID: 592)
      • iexplore.exe (PID: 2268)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2436)
      • iexplore.exe (PID: 1768)
    • Changes internet zones settings

      • iexplore.exe (PID: 592)
      • iexplore.exe (PID: 2268)
    • Creates files in the user directory

      • iexplore.exe (PID: 2436)
      • iexplore.exe (PID: 1768)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2436)
      • iexplore.exe (PID: 592)
      • iexplore.exe (PID: 1768)
      • iexplore.exe (PID: 2268)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 592)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1768)
    • Changes settings of System certificates

      • iexplore.exe (PID: 1768)
    • Application was dropped or rewritten from another process

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Loads dropped or rewritten executable

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Creates a software uninstall entry

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
    • Creates files in the program directory

      • F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp (PID: 2232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:06:01 08:45:10+02:00
PEType: PE32
LinkerVersion: 12
CodeSize: 330752
InitializedDataSize: 2915840
UninitializedDataSize: -
EntryPoint: 0x2e4b5
OSVersion: 5.1
ImageVersion: 0.1
SubsystemVersion: 5.1
Subsystem: Windows command line
FileVersionNumber: 4.5.10.6
ProductVersionNumber: 4.5.10.6
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
ProductVersion: 4.5.10.6
ProductName: RUIRTI
InternalName: RUIRTI.EXE
CompanyName: ©Dyferled
FileVersion: 4.5.10.6
LegalCopyright: ©Dyferled
OriginalFileName: ruirti.exe

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 01-Jun-2015 06:45:10
Detected languages:
  • English - United States
ProductVersion: 4.5.10.6
ProductName: RUIRTI
InternalName: RUIRTI.EXE
CompanyName: ©Dyferled
FileVersion: 4.5.10.6
LegalCopyright: ©Dyferled
OriginalFilename: ruirti.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 01-Jun-2015 06:45:10
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00050A11
0x00050C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41442
.rdata
0x00052000
0x0000AF6A
0x0000B000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.71655
.data
0x0005D000
0x03A335AC
0x00140E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.23173
.0sniit
0x03A91000
0x000A8060
0x000A8200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.06976
.h97iol
0x03B3A000
0x000D3178
0x000D3200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.25115
.rsrc
0x03C0E000
0x00000A48
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.98091

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.07794
1223
Latin 1 / Western European
English - United States
RT_MANIFEST

Imports

KERNEL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
21
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start #ADLOAD 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe iexplore.exe iexplore.exe installer_campaign_14978.exe 773bf49f-351b-43ff-9fe5-3da329fb098d.exe coretempapp.exe iexplore.exe 66ca46d1-5e6d-49ad-aed4-14b3932e7259.exe iexplore.exe #MAILRU 1c8deaaa-fee8-4816-9b25-7cfa10b74a5a.exe coretempapp.exe no specs f4c34370-68f4-4c02-a2ca-6180ad96a9d0.exe f4c34370-68f4-4c02-a2ca-6180ad96a9d0.tmp taskkill.exe no specs smappscontroller.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs mweshield.exe no specs mweshieldup.exe no specs 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
592"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1768"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2268 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2112"C:\Windows\System32\schtasks.exe" /delete /f /tn "CheckControllerUpdatesCore"C:\Windows\System32\schtasks.exeF4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2120"C:\Program Files\Smart Application Controller\smappscontroller.exe" -frominstaller -silentC:\Program Files\Smart Application Controller\smappscontroller.exe
F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp
User:
admin
Company:
Smart Application Controller
Integrity Level:
HIGH
Description:
Smart Application Controller
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\smart application controller\smappscontroller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2144"C:\Program Files\My Web Shield\mweshieldup.exe" /ServiceC:\Program Files\My Web Shield\mweshieldup.exe773BF49F-351B-43FF-9FE5-3DA329FB098D.exe
User:
admin
Company:
"My Web Shield"
Integrity Level:
HIGH
Description:
My Web Shield Consolidator
Exit code:
0
Version:
3.0.0.0
Modules
Images
c:\program files\my web shield\mweshieldup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2152"C:\Windows\System32\taskkill.exe" /F /IM smappscontroller.exeC:\Windows\System32\taskkill.exeF4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2232"C:\Users\admin\AppData\Local\Temp\is-LEH8T.tmp\F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp" /SL5="$202C2,2554955,467456,C:\Users\admin\AppData\Local\Temp\F4C34370-68F4-4C02-A2CA-6180AD96A9D0\F4C34370-68F4-4C02-A2CA-6180AD96A9D0.exe" /VERYSILENT /SUPPRESSMESSAGESC:\Users\admin\AppData\Local\Temp\is-LEH8T.tmp\F4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp
F4C34370-68F4-4C02-A2CA-6180AD96A9D0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-leh8t.tmp\f4c34370-68f4-4c02-a2ca-6180ad96a9d0.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2268"C:\Program Files\Internet Explorer\iexplore.exe" http://regotouty.ru/C:\Program Files\Internet Explorer\iexplore.exe
CoreTempApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2280"C:\Users\admin\AppData\Local\Temp\1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A\1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe" --silent --install_browser_class=0 --pay_browser_class=0 "--rfr=hp.1:834408,dse.1:811570,vbm.1:811580,pult.1:811580,hp.2:834423,dse.2:811610,vbm.2:811620,pult.2:811620,any:811550,any.2:811590" "--install_callback=http://masaki.site/api_v2/callback/?guid={guid}&br={browser}&comp={component}&paid={paid}&pb={paidBrowser}&pa={paidAction}&ibc={installBrowserClass}&pbc={payBrowserClass}&ur={unpaidActionReason}&browserclass1={browserClass1}&browserclass2={browserClass2}&rfr={rfr}&clid=205694340&dlid=326656665"C:\Users\admin\AppData\Local\Temp\1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A\1C8DEAAA-FEE8-4816-9B25-7CFA10B74A5A.exe
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
User:
admin
Integrity Level:
HIGH
Description:
sputnik
Exit code:
0
Version:
5.1.0.194
Modules
Images
c:\users\admin\appdata\local\temp\1c8deaaa-fee8-4816-9b25-7cfa10b74a5a\1c8deaaa-fee8-4816-9b25-7cfa10b74a5a.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2328"C:\Windows\System32\schtasks.exe" /delete /f /tn "CheckControllerUpdatesUA"C:\Windows\System32\schtasks.exeF4C34370-68F4-4C02-A2CA-6180AD96A9D0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
4 714
Read events
3 808
Write events
898
Delete events
8

Modification events

(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_CURRENT_USER\Software\Downloader
Operation:writeName:quarantine
Value:
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4088) 9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
49
Suspicious files
5
Text files
39
Unknown types
8

Dropped files

PID
Process
Filename
Type
40889b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exeC:\Users\admin\AppData\Local\Temp\Downloader\tempicon.ico
MD5:
SHA256:
592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico
MD5:
SHA256:
592iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\ya_ru[1].txt
MD5:
SHA256:
2436iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@yandex[1].txt
MD5:
SHA256:
3804773BF49F-351B-43FF-9FE5-3DA329FB098D.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\300[1]text
MD5:
SHA256:
2436iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\PrivacIE\index.datdat
MD5:
SHA256:
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\c8YYyGzqmycLdYVlesaq8A3I8[1].csstext
MD5:
SHA256:
3908installer_campaign_14978.exeC:\Users\admin\AppData\Roaming\CoreTempApp\CoreTempApp.exeexecutable
MD5:
SHA256:
2436iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\c8YYyGzqmycLdYVlesaq8A3I8[1].csstext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
69
DNS requests
27
Threats
42

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
HEAD
302
87.250.250.242:80
http://ya.ru/?hh
RU
whitelisted
2436
iexplore.exe
GET
302
87.250.250.242:80
http://ya.ru/?hh
RU
whitelisted
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
POST
88.208.33.129:80
http://masaki.site/api_v2/json/get/campaigns?blankId=381716
NL
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
GET
200
88.208.33.129:80
http://masaki.site/icons/2.ico
NL
image
21.8 Kb
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
POST
88.208.33.129:80
http://masaki.site/api_v2/json/send/analyticsreport
NL
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
POST
88.208.33.129:80
http://masaki.site/api_v2/json/send/executereport
NL
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
POST
88.208.33.129:80
http://masaki.site/api_v2/json/get/initialization
NL
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
GET
200
88.208.33.129:80
http://masaki.site/upload/4b3fedd488b3a4b8fe830cd8f107158b.exe
NL
executable
2.84 Mb
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
GET
200
88.208.33.129:80
http://masaki.site/upload/9b33448929168974fa305a0ec4a35bc9.exe
NL
executable
623 Kb
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
GET
200
88.208.33.129:80
http://masaki.site/upload/e604a4c61e5314a46052e8246faba1cainstaller_campaign_14978.exe
NL
executable
548 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
88.208.33.129:80
masaki.site
DataWeb Global Group B.V.
NL
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
217.69.139.110:80
sputnikmailru.cdnmail.ru
Limited liability company Mail.Ru
RU
malicious
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
87.250.250.242:80
ya.ru
YANDEX LLC
RU
whitelisted
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
87.250.250.242:443
ya.ru
YANDEX LLC
RU
whitelisted
2436
iexplore.exe
87.250.250.242:80
ya.ru
YANDEX LLC
RU
whitelisted
592
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2436
iexplore.exe
87.250.250.242:443
ya.ru
YANDEX LLC
RU
whitelisted
2436
iexplore.exe
178.154.131.217:443
yastatic.net
YANDEX LLC
RU
whitelisted
3804
773BF49F-351B-43FF-9FE5-3DA329FB098D.exe
88.208.5.120:80
mywebshield-ww1.com
DataWeb Global Group B.V.
NL
malicious
3804
773BF49F-351B-43FF-9FE5-3DA329FB098D.exe
88.208.5.119:80
getmywebshield.org
DataWeb Global Group B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
masaki.site
  • 88.208.33.129
malicious
sputnikmailru.cdnmail.ru
  • 217.69.139.110
unknown
ya.ru
  • 87.250.250.242
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
yastatic.net
  • 178.154.131.217
  • 178.154.131.216
  • 178.154.131.215
whitelisted
mywebshield-ww1.com
  • 88.208.5.120
malicious
getmywebshield.org
  • 88.208.5.119
unknown
yandex.ru
  • 5.255.255.88
  • 77.88.55.88
  • 5.255.255.5
  • 77.88.55.50
whitelisted
mc.yandex.ru
  • 87.250.250.119
  • 77.88.21.119
  • 93.158.134.119
  • 87.250.251.119
whitelisted
www.tns-counter.ru
  • 194.226.130.228
  • 194.226.130.226
  • 194.226.130.229
  • 194.226.130.227
whitelisted

Threats

PID
Process
Class
Message
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Misc activity
ADWARE [PTsecurity] AdLoad CnC Reverse Base64 POST
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
4088
9b0ad91a9c56bad5c44512d7b5ef53cc0f7c6192693bc2bdfa70dd18e4f37c3a.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
9 ETPRO signatures available at the full report
No debug info