analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin

Full analysis: https://app.any.run/tasks/aa856783-68cd-41fe-9a12-d3c8627a1ecf
Verdict: Malicious activity
Analysis date: May 20, 2019, 04:25:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

A04EB443870896FBE9A0B6468C4844F7

SHA1:

E3001EF25B1386763CAEC9B5339EC6DDB0275A71

SHA256:

A867DEB1578088D066941C40E598E4523AB5FD6C3327D3AFB951073BEE59FB02

SSDEEP:

6144:JrazEX0203RegvjxnpGhu3BJMIp2CuvY63:B+3JpGEBJMg2CuvY6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 3264)

    • Deletes shadow copies

      • cmd.exe (PID: 3264)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe (PID: 2956)

    • Creates files in the user directory

      • a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe (PID: 2956)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:01 18:55:49+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 193536
InitializedDataSize: 23552
UninitializedDataSize: -
EntryPoint: 0x1cc94
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 01-Mar-2019 17:55:49
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 01-Mar-2019 17:55:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002F298
0x0002F400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.65309
.data
0x00031000
0x000059EA
0x00005A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.35317
.rsrc
0x00037000
0x000001F8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.84518

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89724
405
UNKNOWN
English - United States
RT_MANIFEST

Imports

COMCTL32.dll
KERNEL32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe no specs cmd.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Users\admin\AppData\Local\Temp\a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe" C:\Users\admin\AppData\Local\Temp\a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
3264cmd /c ""C:\Users\admin\AppData\Local\Temp\clearnetworkdns_11-22-33.bat" "C:\Windows\system32\cmd.exe—a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3396vssadmin Delete Shadows /all /quietC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2936vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MBC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1352vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unboundedC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2488vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MBC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1904vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unboundedC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3524vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MBC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2608vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unboundedC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3180vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MBC:\Windows\system32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
356
Read events
352
Write events
4
Delete events
0

Modification events

(PID) Process:(2956) a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2956) a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
110
Text files
23
Unknown types
3

Dropped files

PID
Process
Filename
Type
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.CIopbinary
MD5:B6CA71E2F22E9B55F51E72E7581CCACD
SHA256:0CC6EDBEC0C1F1CAB180D63E026030034B8EA31D85C224A63708120027F3BF85
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:F05DB5D013B064E35D41D86B72D68E39
SHA256:6E973D0F79F5407FC77B69EA5ED66217B7B8ED5D30FBD88251DB957D42BCB69F
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\westdiscussion.rtf.CIopbinary
MD5:37498EDE0D2946D2EDF18431D991E021
SHA256:FB9E7DCC35D7134B414429DAC41550DD1982BA72961FFEC1B74DAE844F2C7110
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\clearfeedback.rtf.CIopbinary
MD5:3AB8B8F66B1AE20BB671F0920EBEBE44
SHA256:CC5D1BE7BB1F71A95020114D864C0E59371E6FCC424BE6985E2E66192D96B034
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\easilya.rtf.CIopbinary
MD5:A93B534E1EC57116BADD4E24D51D3B6E
SHA256:6B4C7D0CF4FA2C607243C4C5E9CD34149DA20F911B27868932CD2714389543A3
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\friendsside.rtf.CIopbinary
MD5:4ED4EFD2BA6865452BA4B02C653A96A7
SHA256:707774747E0A575937B9C6847823B7AB2B32AF268BCB600089E50CF398B63BB0
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Contacts\admin.contact.CIopbinary
MD5:D322758C2C4D7437C0A3D48372F80179
SHA256:D5237E5B2DBB034C8A109A7533C047C53D09EDBB28F0095557B13309B6914B78
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\pointsinvestment.rtf.CIopbinary
MD5:D1125ED0D01A76F81F4F6EB6CD701F90
SHA256:0697D7239203E807F38C37B5D51F9C840109EF72CFE9698CF5EBCFF1129D3668
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\pagesix.rtf.CIopbinary
MD5:0D78562AD5EA02E4D68F41779FF2E3CD
SHA256:33627E2F23838E327B1BBB7D705FC9C24270122C9C46DD36776102BB0B360E55
2956a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin.exeC:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.CIopbinary
MD5:C45F008AC9D9BA82F0E0F337687A2D90
SHA256:C164052FA1D505399161499816C2BB600B2209CE7C8BDFA231274E7EEFFB696F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02.bin