analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe

Full analysis: https://app.any.run/tasks/a8e04b84-4e51-459e-963e-904541037985
Verdict: Malicious activity
Analysis date: June 27, 2022, 13:18:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6209D516E4CA3BB294C8EB296D265B2C

SHA1:

7D23625B69E9D0498538C3317053F6EDD97FB8F2

SHA256:

9B0CB066877576F405C688D2D06A076897104968D42958DC4309B69C04F435A3

SSDEEP:

3072:ftgACFxBaj+nL4IkcRDNiHGG6C57Q+hjXy5GXxLwOyR/2+KTRK7iwj+MfG+:ft9YxMj+L4hmHsXyYXOOSgNdwXG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Writes to a start menu file

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Uses SVCHOST.EXE for hidden code execution

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Changes the autorun value in the registry

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)
      • mspaint.exe (PID: 1276)

    • Drops executable file immediately after starts

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Application was injected by another process

      • Dwm.exe (PID: 552)
      • Explorer.EXE (PID: 1172)
      • taskeng.exe (PID: 284)
      • DllHost.exe (PID: 2724)
      • ctfmon.exe (PID: 1372)

    • Runs injected code in another process

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 3988)

  • SUSPICIOUS

    • Checks supported languages

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)
      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 3988)

    • Application launched itself

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Creates files in the user directory

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Reads the computer name

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)
      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 3988)

    • Drops a file with a compile date too recent

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

    • Executable content was dropped or overwritten

      • 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe (PID: 1568)

  • INFO

    • Checks supported languages

      • svchost.exe (PID: 3944)
      • mspaint.exe (PID: 1276)
      • DllHost.exe (PID: 2724)

    • Reads the computer name

      • DllHost.exe (PID: 2724)
      • svchost.exe (PID: 3944)
      • mspaint.exe (PID: 1276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

LegalTrademarks: Pexacev Hukip Ygapo Pusys Badep Rox
FileDescription: Comile Esuq Wuhitac
CompanyName: PalmSource, Inc.
ProductVersion: 10, 3
OriginalFileName: Rajqjr63ugg.exe
FileVersion: 10, 3, 3
InternalName: Sox
ProductName: Ypitih
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 10.3.0.0
FileVersionNumber: 10.3.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x12e79
UninitializedDataSize: -
InitializedDataSize: 46080
CodeSize: 78336
LinkerVersion: 4
PEType: PE32
TimeStamp: 2000:11:18 16:20:42+01:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start inject inject inject inject 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe svchost.exe no specs 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe no specs mspaint.exe taskeng.exe dwm.exe explorer.exe ctfmon.exe DllHost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1568"C:\Users\admin\AppData\Local\Temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe" C:\Users\admin\AppData\Local\Temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
Explorer.EXE
User:
admin
Company:
PalmSource, Inc.
Integrity Level:
MEDIUM
Description:
Comile Esuq Wuhitac
Exit code:
0
Version:
10, 3, 3
Modules
Images
c:\users\admin\appdata\local\temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3944"C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe—9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\mspaint.exe
c:\windows\system32\gdi32.dll
3988"C:\Users\admin\AppData\Local\Temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe" C:\Users\admin\AppData\Local\Temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe—9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\secur32.dll
c:\windows\system32\nsi.dll
1276"C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
284taskeng.exe {676F38EF-2AEC-4A4B-BA70-4C8C7218D1B1}C:\Windows\system32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
552"C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1172C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1372C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2724C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}C:\Windows\system32\DllHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 884
Read events
1 794
Write events
89
Delete events
1

Modification events

(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Screen Saver Pro 3.1
Value:
C:\Users\admin\AppData\Roaming\ScreenSaverPro.scr
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1568) 9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
15689b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NTDETECT.COMexecutable
MD5:6209D516E4CA3BB294C8EB296D265B2C
SHA256:9B0CB066877576F405C688D2D06A076897104968D42958DC4309B69C04F435A3
15689b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeC:\Users\admin\AppData\Roaming\temp.binexecutable
MD5:6209D516E4CA3BB294C8EB296D265B2C
SHA256:9B0CB066877576F405C688D2D06A076897104968D42958DC4309B69C04F435A3
15689b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeC:\Users\admin\AppData\Roaming\ScreenSaverPro.screxecutable
MD5:6209D516E4CA3BB294C8EB296D265B2C
SHA256:9B0CB066877576F405C688D2D06A076897104968D42958DC4309B69C04F435A3
15689b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exeC:\Users\admin\AppData\Local\Temp\9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe.gonewiththewingsexecutable
MD5:6209D516E4CA3BB294C8EB296D265B2C
SHA256:9B0CB066877576F405C688D2D06A076897104968D42958DC4309B69C04F435A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1276
mspaint.exe
199.2.137.29:7380
j.joyyv03.com
Microsoft Corporation
US
whitelisted
1568
9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe
51.15.12.156:80
apt.wipmania.net
Online S.a.s.
NL
suspicious

DNS requests

Domain
IP
Reputation
apt.wipmania.net
  • 51.15.12.156
suspicious
api.wipmania.com
  • 127.0.0.1
unknown
j.joyyv03.com
  • 199.2.137.29
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
j.balkr03.com
  • 199.2.137.29
malicious

Threats

PID
Process
Class
Message
1276
mspaint.exe
Generic Protocol Command Decode
SURICATA STREAM TIMEWAIT ACK with wrong seq
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9b0cb066877576f405c688d2d06a076897104968d42958dc4309b69c04f435a3.exe