analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

amsi.exe

Full analysis: https://app.any.run/tasks/9a520342-8348-40c4-9d89-fc070ea56845
Verdict: Malicious activity
Analysis date: June 11, 2019, 22:33:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

40C06C854E8D7F93D1E174FDC7ABF8BC

SHA1:

D45B97E06FFDFF3068F43F7695F3EAAE439B27A4

SHA256:

AC2B263A850B69C01B2DFC8544B5196D3FC947F5E96D389A341DDC6CEE4E077E

SSDEEP:

3072:8kiTRuLfL4RsuqUXNWOCWih8pnkNPR++ExeAK2oTgtcn0uxF5Rgex6MBRh/Do2k:HiTRuLgTNZ7u92Ogt4dx3dxpnhQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses SVCHOST.EXE for hidden code execution

      • amsi.exe (PID: 3436)
      • wwjaykqgbjn.exe (PID: 2280)

    • Loads the Task Scheduler COM API

      • svchost.exe (PID: 2392)
      • mmc.exe (PID: 1520)

    • Application was dropped or rewritten from another process

      • wwjaykqgbjn.exe (PID: 1496)
      • wwjaykqgbjn.exe (PID: 2280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 2392)

    • Creates files in the program directory

      • svchost.exe (PID: 2392)

    • Application launched itself

      • amsi.exe (PID: 3376)
      • wwjaykqgbjn.exe (PID: 1496)

    • Executed via Task Scheduler

      • wwjaykqgbjn.exe (PID: 1496)

  • INFO

    • Manual execution by user

      • mmc.exe (PID: 1520)
      • mmc.exe (PID: 2576)
      • opera.exe (PID: 3972)

    • Creates files in the user directory

      • opera.exe (PID: 3972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x71c9
UninitializedDataSize: -
InitializedDataSize: 245248
CodeSize: 83456
LinkerVersion: 12
PEType: PE32
TimeStamp: 2018:01:17 14:52:52+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 17-Jan-2018 13:52:52
Debug artifacts:
  • C:\bije.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 17-Jan-2018 13:52:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x0003E000
0x0000D3AC
0x0000C600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.99381
.rdata
0x00016000
0x0000747C
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.74176
.data
0x0001E000
0x0001F120
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.59959
.rsrc
0x0004C000
0x00007898
0x00007A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14073
.reloc
0x00054000
0x00001434
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.33793

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.84534
3752
UNKNOWN
UNKNOWN
RT_ICON
2
4.15234
2216
UNKNOWN
UNKNOWN
RT_ICON
3
3.96979
1736
UNKNOWN
UNKNOWN
RT_ICON
4
3.85587
1384
UNKNOWN
UNKNOWN
RT_ICON
5
4.30653
9640
UNKNOWN
UNKNOWN
RT_ICON
6
4.86693
4264
UNKNOWN
UNKNOWN
RT_ICON
7
4.52966
2440
UNKNOWN
UNKNOWN
RT_ICON
8
4.32105
1128
UNKNOWN
UNKNOWN
RT_ICON
22
3.22204
1266
UNKNOWN
UNKNOWN
RT_STRING
23
3.28327
1550
UNKNOWN
UNKNOWN
RT_STRING

Imports

ADVAPI32.dll
KERNEL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start amsi.exe no specs amsi.exe no specs svchost.exe mmc.exe no specs mmc.exe wwjaykqgbjn.exe no specs wwjaykqgbjn.exe no specs svchost.exe no specs opera.exe

Process information

PID
CMD
Path
Indicators
Parent process
3376"C:\Users\admin\AppData\Local\Temp\amsi.exe" C:\Users\admin\AppData\Local\Temp\amsi.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3436"C:\Users\admin\AppData\Local\Temp\amsi.exe" -q=2416788192C:\Users\admin\AppData\Local\Temp\amsi.exe—amsi.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2392C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe
amsi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2576"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1520"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1496C:\ProgramData\{C654A916-CA16-4424-BE78-3EE7C63190B2}\{4654A917-CA17-4424-BE79-3EE7CA3190B2}\wwjaykqgbjn.exe C:\ProgramData\{C654A916-CA16-4424-BE78-3EE7C63190B2}\{4654A917-CA17-4424-BE79-3EE7CA3190B2}\wwjaykqgbjn.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2280C:\ProgramData\{C654A916-CA16-4424-BE78-3EE7C63190B2}\{4654A917-CA17-4424-BE79-3EE7CA3190B2}\wwjaykqgbjn.exe -q=2416793153C:\ProgramData\{C654A916-CA16-4424-BE78-3EE7C63190B2}\{4654A917-CA17-4424-BE79-3EE7CA3190B2}\wwjaykqgbjn.exe—wwjaykqgbjn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
536C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe—wwjaykqgbjn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3972"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Version:
1748
Total events
268
Read events
208
Write events
60
Delete events
0

Modification events

(PID) Process:(1520) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:HelpTopic
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(1520) mmc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{c7b8fb06-bfe1-4c2e-9217-7a69a95bbac4}
Operation:writeName:LinkedHelpTopics
Value:
C:\Windows\Help\taskscheduler.chm
(PID) Process:(3972) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe
(PID) Process:(3972) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
44
Text files
65
Unknown types
23

Dropped files

PID
Process
Filename
Type
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr4266.tmp —
MD5:—
SHA256:—
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr42A6.tmp —
MD5:—
SHA256:—
3972opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00001.tmp —
MD5:—
SHA256:—
3972opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JISF5RFBQ0THNILN9E23.temp —
MD5:—
SHA256:—
2392svchost.exeC:\ProgramData\{C654A916-CA16-4424-BE78-3EE7C63190B2}\{4654A917-CA17-4424-BE79-3EE7CA3190B2}\wwjaykqgbjn.exeexecutable
MD5:0CC1F6D39B87D45E4041FFA75E760FC0
SHA256:6708AF60D0C50282409D6A30C05542E3FC4D7F5931145EB2F1A36B0D3DE16E5E
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:F8B1FCB365A27C2C9730D8B283A7F454
SHA256:A9B8EDACF385F4775A6585703D82A1D0E66AD72B2CC6A1A56AAD221E10FBA1DD
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:D9B4D5E52D815B0937C48CF13ECB6BED
SHA256:9BB19AAB3D01694F09464F3322A8A25D5ED2DDECF54DE092670117C4F00EF104
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:C6FA8676009CADC14F43EABD11449B0A
SHA256:49984A9D756551CDBEEB98A5611DD9DDBBF65D8E1916B5DF688AA48FAA3D8663
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprC082.tmp —
MD5:—
SHA256:—
3972opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprCC5A.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
49
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
opera.exe
GET
400
185.26.182.112:80
http://sitecheck2.opera.com/?host=chase.com&hdn=Vu%2BzlKTnzN7rHs19Aeipxw==
unknown
html
150 b
whitelisted
3972
opera.exe
GET
301
159.53.85.137:80
http://chase.com/
US
—
—
suspicious
3972
opera.exe
GET
200
104.121.24.251:80
http://ocsp.entrust.net/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCEQD9e1BR8AutbgAAAABUz5cI
NL
der
1.90 Kb
whitelisted
3972
opera.exe
GET
—
104.123.50.17:80
http://crl.entrust.net/g2ca.crl
US
—
—
whitelisted
3972
opera.exe
GET
200
104.121.24.251:80
http://ocsp.entrust.net/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCEQD9e1BR8AutbgAAAABUz5cI
NL
der
1.90 Kb
whitelisted
3972
opera.exe
GET
200
104.121.24.251:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCEEhX3tOSiXkaAAAAAFTPzbw%3D
NL
der
1.90 Kb
whitelisted
3972
opera.exe
GET
200
104.121.24.251:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQnuEQcScL%2FkljKed%2BRzpzFYOq9kwQUw%2FfQtSowra8NkSFwOVTdvIlwxzoCEBy4c2rWq6eqAAAAAFTPYF4%3D
NL
der
1.90 Kb
whitelisted
3972
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
543 b
whitelisted
3972
opera.exe
GET
200
172.217.18.206:80
http://clients1.google.com/complete/search?q=chas&client=opera-suggest-omnibox&hl=de
US
text
112 b
whitelisted
3972
opera.exe
GET
200
104.123.50.17:80
http://crl.entrust.net/g2ca.crl
US
der
1.45 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3972
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
3972
opera.exe
185.26.182.112:443
sitecheck2.opera.com
Opera Software AS
—
malicious
3972
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3972
opera.exe
185.26.182.112:80
sitecheck2.opera.com
Opera Software AS
—
malicious
3972
opera.exe
159.53.116.62:443
www.chase.com
JPMorgan Chase & Co.
US
suspicious
3972
opera.exe
159.53.85.137:80
chase.com
JPMorgan Chase & Co.
US
suspicious
3972
opera.exe
172.217.18.206:80
clients1.google.com
Google Inc.
US
whitelisted
3972
opera.exe
104.123.50.17:80
crl.entrust.net
Akamai Technologies, Inc.
US
whitelisted
3972
opera.exe
104.121.24.251:80
ocsp.entrust.net
Akamai Technologies, Inc.
NL
whitelisted
3972
opera.exe
159.53.98.41:443
sites.chase.com
JPMorgan Chase & Co.
US
unknown

DNS requests

Domain
IP
Reputation
certs.opera.com
  • 185.26.182.93
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
clients1.google.com
  • 172.217.18.206
whitelisted
chase.com
  • 159.53.85.137
suspicious
sitecheck2.opera.com
  • 185.26.182.112
whitelisted
www.chase.com
  • 159.53.116.62
whitelisted
ocsp.entrust.net
  • 104.121.24.251
whitelisted
crl.entrust.net
  • 104.123.50.17
whitelisted
sites.chase.com
  • 159.53.98.41
unknown
rf15.chase.com
  • 159.53.119.16
unknown

Threats

No threats detected
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
amsi.exe