analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

mn.exe

Full analysis: https://app.any.run/tasks/50c35073-04be-4461-b9ff-7383ad8acb10
Verdict: Malicious activity
Analysis date: March 21, 2019, 13:25:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

66EA09330BEE7239FCB11A911F8E8EA3

SHA1:

4825E41524DECDB4B8A68205D9A4CD1D1AF501C0

SHA256:

AAEF385A090D83639FB924C679B2FF22E90AE9377774674D537670A975513397

SSDEEP:

3072:H31w+JUlVQSMGYSIfSHMC77JKhmSeVHCJK4:H3IQF3SIavfJKjad4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to a start menu file

      • cmd.exe (PID: 3016)
      • mn.exe (PID: 1896)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3572)
      • schtasks.exe (PID: 124)
      • schtasks.exe (PID: 3408)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1524)
  • SUSPICIOUS

    • Creates files in the user directory

      • cmd.exe (PID: 3016)
      • cmd.exe (PID: 3116)
    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3016)
      • cmd.exe (PID: 3116)
    • Starts CMD.EXE for commands execution

      • mn.exe (PID: 1896)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 1524)
    • Uses WMIC.EXE to obtain a list of video controllers

      • zlyH0Kga.exe (PID: 1436)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:12 08:57:49+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 124928
InitializedDataSize: 9728
UninitializedDataSize: 3072
EntryPoint: 0xd0c8
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Mar-2019 07:57:49
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 12-Mar-2019 07:57:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.data
0x00001000
0x0001E6E4
0x0001E800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.4281
.bss
0x00020000
0x00000A68
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00021000
0x00000DA2
0x00000E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.39667
.rsrc
0x00022000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.70436
.reloc
0x00023000
0x00001414
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.32996

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
SHLWAPI.dll
USER32.dll
urlmon.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
17
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mn.exe cmd.exe cmd.exe no specs cmd.exe cmd.exe no specs sc.exe no specs ping.exe no specs cmd.exe no specs zlyh0kga.exe sc.exe no specs findstr.exe no specs schtasks.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs wmic.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1896"C:\Users\admin\AppData\Local\Temp\mn.exe" C:\Users\admin\AppData\Local\Temp\mn.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3016/c "C:\Users\admin\AppData\Local\Temp\1018718.bat"C:\Windows\system32\cmd.exe
mn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
128/c "C:\Users\admin\AppData\Local\Temp\1022906.bat"C:\Windows\system32\cmd.exemn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3116/c "C:\Users\admin\AppData\Local\Temp\1024906.bat"C:\Windows\system32\cmd.exe
mn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1524cmd /c start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&(schtasks /delete /TN 24kbnmDGBs /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN 24kbnmDGBs /tr "cmd.exe /c C:\Windows\MvHBCLhR.exe"&schtasks /run /TN 24kbnmDGBs)C:\Windows\system32\cmd.exemn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2812sc start ScheduleC:\Windows\system32\sc.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2244ping localhostC:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3556/c "C:\Users\admin\AppData\Local\Temp\1029875.bat"C:\Windows\system32\cmd.exemn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1436"C:\Users\admin\AppData\Roaming\zlyH0Kga.exe"C:\Users\admin\AppData\Roaming\zlyH0Kga.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
2772sc query ScheduleC:\Windows\system32\sc.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
166
Read events
148
Write events
18
Delete events
0

Modification events

(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(1436) zlyH0Kga.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\zlyH0Kga_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
2
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1896mn.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VifomrAM.exe
MD5:
SHA256:
1896mn.exeC:\Users\admin\AppData\Roaming\zlyH0Kga.exe
MD5:
SHA256:
1896mn.exeC:\Users\admin\AppData\Local\Temp\1024906.battext
MD5:A18F07737790E5A83B2003F681272509
SHA256:F13C64819F62711DA6C537228F248D21E7E2AB1DDE06EC9683D21557D6FE5742
1896mn.exeC:\Users\admin\AppData\Local\Temp\1018718.battext
MD5:EFA1B22BBCA0A2363150557CBE543B72
SHA256:75B39A50F822A051590542F38177D81ECAB92C1D086CE26F4B5B4AD220CCC850
3116cmd.exeC:\Users\admin\AppData\Roaming\zlyH0Kga.exeexecutable
MD5:66EA09330BEE7239FCB11A911F8E8EA3
SHA256:AAEF385A090D83639FB924C679B2FF22E90AE9377774674D537670A975513397
1896mn.exeC:\Users\admin\AppData\Local\Temp\1022906.battext
MD5:D9BDA3D37FD2C739C29AD9BCE2BB8425
SHA256:E67D781AD599C3B1C7D7FB30FE9D1A79699990371AB251A334D61BE52119AB09
1896mn.exeC:\Users\admin\AppData\Local\Temp\1029875.battext
MD5:C45B9DDB577942C76799AD82D9C1DBC1
SHA256:FD5F74B03E65825DA0A3239233E03A4C95AA36A96B43D412915D4F3E5EB5EA29
3016cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VifomrAM.exeexecutable
MD5:66EA09330BEE7239FCB11A911F8E8EA3
SHA256:AAEF385A090D83639FB924C679B2FF22E90AE9377774674D537670A975513397
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1436
zlyH0Kga.exe
GET
200
153.92.4.49:80
http://pp.abbny.com/t.php?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&MAC=52:54:00:4A:04:AF&OS=Windows%207&BIT=32&CARD=Standard%20VGA%20Graphics%20Adapter&_T=1553174795
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1436
zlyH0Kga.exe
153.92.4.49:80
pp.abbny.com
US
suspicious

DNS requests

Domain
IP
Reputation
ii.ackng.com
malicious
pp.abbny.com
  • 153.92.4.49
malicious
oo.beahh.com
malicious

Threats

PID
Process
Class
Message
1436
zlyH0Kga.exe
A Network Trojan was detected
MALWARE [PTsecurity] TrojanDropper:Win32/Fakewmi.A
No debug info