File name:

file

Full analysis: https://app.any.run/tasks/37b5061f-d4c0-4802-a6b9-d587e027104e
Verdict: Malicious activity
Analysis date: December 02, 2023, 09:10:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

6F5BAD34630757F92632E3691314AB90

SHA1:

66215D8C4B00C7498D62BFCC9E805F075FBE2F89

SHA256:

9C8842F212BAE9485736D671DFC506632E80D0F11DF8BF926AAED73FF48B32FF

SSDEEP:

98304:QGiMhc9jyX0C0kSyA4SpshtXF2jIyXRl1oNypRagKxq98yjs34EOhpREkDJm2cxr:AyMeAGgMvwQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 3028)

    • Actions looks like stealing of personal data

      • file.exe (PID: 3028)

  • SUSPICIOUS

    • Reads the Internet Settings

      • file.exe (PID: 3028)

    • Connects to unusual port

      • file.exe (PID: 3028)

    • The process verifies whether the antivirus software is installed

      • file.exe (PID: 3028)

  • INFO

    • Checks supported languages

      • file.exe (PID: 3028)

    • Reads the computer name

      • file.exe (PID: 3028)

    • Checks proxy server information

      • file.exe (PID: 3028)

    • Reads the machine GUID from the registry

      • file.exe (PID: 3028)

    • Create files in a temporary directory

      • file.exe (PID: 3028)

    • Creates files or folders in the user directory

      • file.exe (PID: 3028)

    • Creates files in the program directory

      • file.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 04:09:37+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 117760
UninitializedDataSize: 1024
EntryPoint: 0x3382
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe file.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3028"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
950
Read events
944
Write events
6
Delete events
0

Modification events

(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3028) file.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsq2E2F.tmp\Checker.dll
Executable files
5
Suspicious files
42
Text files
177
Unknown types
0

Dropped files

PID
Process
Filename
Type
3028file.exeC:\Windows\servicing\Editions\CabInfo.dllexecutable
MD5:7AC6E52C84F30D4A3B2F5FC8C40FDBE7
SHA256:713A73F42AF9F45DDDFE99597E7B6186AA6CBCBA8A9214AC953EF54B8FF13F83
3028file.exeC:\Program Files (x86)\ClocX\ClocX.exeexecutable
MD5:2943A5A31664A8183E993D480B8709BC
SHA256:282397F5EFC6B5A517881350736901620649C3CF0A692423CF77B9093F933E8B
3028file.exeC:\Users\admin\AppData\Local\Temp\nsq2E2F.tmp\Zip.dllexecutable
MD5:B803FA39A384FA59FC48FAF6EC082843
SHA256:8EA882CBB8843B0020957488A030F86D1AAEE82D3908350899261853C97F6733
3028file.exeC:\Users\admin\AppData\Local\Temp\nsg2E40.tmpbinary
MD5:615C251B298303A6315577A9EDCF29E7
SHA256:BCEB71407AE4EADB38DDB7E7ED0096507F9BD292261B38DC3E159953AEE6C2B5
3028file.exeC:\Program Files (x86)\ClocX\Lang\Bosanski.lngbinary
MD5:4DAD1A9BFCB103D54B06909ABB097536
SHA256:79DBBB2DE47A367B70646DCCB4AF1DFCD56A9ADCD4959D82612CF6889B1D8CF7
3028file.exeC:\Program Files (x86)\ClocX\BackupAlarms.battext
MD5:C8BF8F5A39C3CD41974F240DE82A0E75
SHA256:CC51C20EF9133B8B13F5DDC0464679B81677413CF34A5B70785ABFEF857367B5
3028file.exeC:\Program Files (x86)\ClocX\Lang\Czech.lngbinary
MD5:A1A459AEBED25C19F29A65E4BA95649C
SHA256:A3BFBCEF85E8317089B62B98265B052949F3B11D0B404526B51AA489C14E5649
3028file.exeC:\Users\admin\AppData\Local\Temp\nsq2E2F.tmp\Checker.dllexecutable
MD5:84C45156C6048B6764BD12ABE86E6497
SHA256:4ACF888EEA6DB480C9724F1DDB587AF5680CAD6F654983097E3806FFE0FB130F
3028file.exeC:\Program Files (x86)\ClocX\Lang\Arabic.lngbinary
MD5:B0277FB1E01F2C417AC128A7E683B81B
SHA256:6F8806A904F7ADED9C217C8A7FA5F38F13CE0BB5F5A21E0CCB74612C9C9B3EB5
3028file.exeC:\Program Files (x86)\ClocX\Lang\French.lngbinary
MD5:7767FBCDA3DB9B77F1E8FEB02172AE34
SHA256:4FFE5D4BF560C15DB2777F0BC31652D7C733DC3CAD3B4E052B10BBD6AF65A0EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3028
file.exe
192.186.7.211:2001
—
FEDERAL-ONLINE-GROUP-LLC
US
unknown
3028
file.exe
38.6.193.13:8889
—
—
—
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info