File name:

file

Full analysis: https://app.any.run/tasks/37b5061f-d4c0-4802-a6b9-d587e027104e
Verdict: Malicious activity
Analysis date: December 02, 2023, 09:10:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

6F5BAD34630757F92632E3691314AB90

SHA1:

66215D8C4B00C7498D62BFCC9E805F075FBE2F89

SHA256:

9C8842F212BAE9485736D671DFC506632E80D0F11DF8BF926AAED73FF48B32FF

SSDEEP:

98304:QGiMhc9jyX0C0kSyA4SpshtXF2jIyXRl1oNypRagKxq98yjs34EOhpREkDJm2cxr:AyMeAGgMvwQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 3028)

    • Actions looks like stealing of personal data

      • file.exe (PID: 3028)

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • file.exe (PID: 3028)

    • Reads the Internet Settings

      • file.exe (PID: 3028)

    • Connects to unusual port

      • file.exe (PID: 3028)

  • INFO

    • Checks supported languages

      • file.exe (PID: 3028)

    • Reads the computer name

      • file.exe (PID: 3028)

    • Reads the machine GUID from the registry

      • file.exe (PID: 3028)

    • Create files in a temporary directory

      • file.exe (PID: 3028)

    • Creates files in the program directory

      • file.exe (PID: 3028)

    • Checks proxy server information

      • file.exe (PID: 3028)

    • Creates files or folders in the user directory

      • file.exe (PID: 3028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 04:09:37+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 117760
UninitializedDataSize: 1024
EntryPoint: 0x3382
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe file.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3028"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
950
Read events
944
Write events
6
Delete events
0

Modification events

(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3028) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3028) file.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsq2E2F.tmp\Checker.dll
Executable files
5
Suspicious files
42
Text files
177
Unknown types
0

Dropped files

PID
Process
Filename
Type
3028file.exeC:\Program Files (x86)\ClocX\Lang\Brazilian Portuguese.lngbinary
MD5:663CA37CB27AA3B419C76F228889B08C
SHA256:CFE734403030DD1A5BDEA2F307FB3416C2DC424AF6C298A127A2CD13900BDE67
3028file.exeC:\Users\admin\AppData\Local\Temp\nsq2E2F.tmp\Zip.dllexecutable
MD5:B803FA39A384FA59FC48FAF6EC082843
SHA256:8EA882CBB8843B0020957488A030F86D1AAEE82D3908350899261853C97F6733
3028file.exeC:\Program Files (x86)\ClocX\BackupAlarms.battext
MD5:C8BF8F5A39C3CD41974F240DE82A0E75
SHA256:CC51C20EF9133B8B13F5DDC0464679B81677413CF34A5B70785ABFEF857367B5
3028file.exeC:\Users\admin\AppData\Local\Temp\nsg2E40.tmpbinary
MD5:615C251B298303A6315577A9EDCF29E7
SHA256:BCEB71407AE4EADB38DDB7E7ED0096507F9BD292261B38DC3E159953AEE6C2B5
3028file.exeC:\Program Files (x86)\ClocX\Lang\Bosanski.lngbinary
MD5:4DAD1A9BFCB103D54B06909ABB097536
SHA256:79DBBB2DE47A367B70646DCCB4AF1DFCD56A9ADCD4959D82612CF6889B1D8CF7
3028file.exeC:\Program Files (x86)\ClocX\ClocX.exeexecutable
MD5:2943A5A31664A8183E993D480B8709BC
SHA256:282397F5EFC6B5A517881350736901620649C3CF0A692423CF77B9093F933E8B
3028file.exeC:\Program Files (x86)\ClocX\Lang\Afrikaans.lngbinary
MD5:7F8D637F9AB63DC4120C6439B19710DA
SHA256:2F7AC68D51C52C33D8186123BD0B7F8A2087EC5E5B3C5BD16FD844AA220774FB
3028file.exeC:\Program Files (x86)\ClocX\Lang\Arabic.lngbinary
MD5:B0277FB1E01F2C417AC128A7E683B81B
SHA256:6F8806A904F7ADED9C217C8A7FA5F38F13CE0BB5F5A21E0CCB74612C9C9B3EB5
3028file.exeC:\Program Files (x86)\ClocX\Lang\Czech.lngbinary
MD5:A1A459AEBED25C19F29A65E4BA95649C
SHA256:A3BFBCEF85E8317089B62B98265B052949F3B11D0B404526B51AA489C14E5649
3028file.exeC:\Program Files (x86)\360\360Safe\deepscan\speedmem2.hgbinary
MD5:B4FAAAC062985E6AA24A795679D964F4
SHA256:5FC29D926B69583E7A442F5569E880618F254E052B26EF7E9CEF3D9D6489EABE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3028
file.exe
192.186.7.211:2001
—
FEDERAL-ONLINE-GROUP-LLC
US
unknown
3028
file.exe
38.6.193.13:8889
—
—
—
unknown

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info