analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe

Full analysis: https://app.any.run/tasks/380d942c-de2d-4de3-bedb-6fe15a0903ec
Verdict: Malicious activity
Analysis date: September 30, 2020, 08:22:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F1B044E9C52A9E2F60051D39000CC046

SHA1:

2AFFEEDAEF525BC9FA609710DEB24AF5477E3D9A

SHA256:

B140231893C88C5D7F9697E5451AE17D69A94688D8FDF1CBE00C9D4794F34D17

SSDEEP:

49152:kHVgiGeFHz8bcbChNhCvNZ4OuzShC8o7S2JP:yginFHz8bhQNBuzntP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Disables Windows Defender

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Changes settings of System certificates

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)
      • msiexec.exe (PID: 2420)

    • Changes Windows auto-update feature

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Loads the Task Scheduler COM API

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

  • SUSPICIOUS

    • Creates or modifies windows services

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Creates files in the program directory

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Application launched itself

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2708)

    • Starts SC.EXE for service management

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Executable content was dropped or overwritten

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)
      • msiexec.exe (PID: 2420)

    • Reads Internet Cache Settings

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Adds / modifies Windows certificates

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)
      • msiexec.exe (PID: 2420)

    • Creates files in the user directory

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Starts Microsoft Installer

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Searches for installed software

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

  • INFO

    • Reads settings of System Certificates

      • b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe (PID: 2768)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1276)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2420)

    • Application launched itself

      • msiexec.exe (PID: 2420)

    • Creates files in the program directory

      • msiexec.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x378000
UninitializedDataSize: -
InitializedDataSize: 556032
CodeSize: 150528
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:07:16 14:29:03+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Jul-2020 12:29:03
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 16-Jul-2020 12:29:03
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x00001000
0x000B3000
0x000B3000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.78159
.rsrc
0x000B4000
0x000003D0
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.23402
.idata
0x000B5000
0x00001000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.30872
0x000B6000
0x00195000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.264678
mimktfre
0x0024B000
0x0012D000
0x0012C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.9303
yvsofpvn
0x00378000
0x00001000
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.06952

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.95975
886
Latin 1 / Western European
English - United States
RT_MANIFEST

Imports

comctl32.dll
kernel32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2708"C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe" C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
2768"C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe" C:\Users\admin\AppData\Local\Temp\b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Integrity Level:
HIGH
2948"C:\Windows\System32\sc.exe" config edgeupdate start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3016"C:\Windows\System32\sc.exe" config MozillaMaintenance start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1724"C:\Windows\System32\sc.exe" stop edgeupdateC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1720"C:\Windows\System32\sc.exe" stop MozillaMaintenanceC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2172"C:\Windows\System32\sc.exe" config edgeupdatem start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2444"C:\Windows\System32\sc.exe" stop edgeupdatemC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2524"C:\Windows\System32\sc.exe" config gupdate start= disabledC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3012"C:\Windows\System32\sc.exe" stop gupdateC:\Windows\System32\sc.exe—b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
5 470
Read events
828
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
28
Text files
3 087
Unknown types
11

Dropped files

PID
Process
Filename
Type
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Local\Temp\CabBD3B.tmp —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Local\Temp\TarBD4C.tmp —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Program Files\Google\Updater —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting —
MD5:—
SHA256:—
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:63AA0ABC8704C19F6C9190592630141F
SHA256:9AC64B606630B298A33F9D6F4C7A06DF169A08D947FC36331F1BB9CC6311CD29
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:49544C1D86C4EA53B303E45248E4B076
SHA256:79A64B6F06DFDD3EA5A47094150FF556E1C65241C6881E6BFF4E2C964B4B6777
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2fbinary
MD5:39E07AB1A9618CD92497C7027A8953BB
SHA256:F1C234509278BD109168C7B96847F0E0EA9A0C1BFCB6FBF43F1ACC448968886B
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_4D6B3EB9FCF965ACEB905EECDEB080B1der
MD5:A738F3940734C509788D8E74019F7E67
SHA256:84F0335706DFC27AC8D08419E74654624F211EF70FF56B8FFB59CD3A2C4CF169
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Windows\Installer\{9FFD2AB7-AE08-4230-ABE7-FD912A563D33}\xmcdakfnhekabpebeccjhmcbiephaiihjmlxml
MD5:1AE6E9FDA9E1B7047C56BB7800065085
SHA256:1F46466865B4293F056C5EB2F46082EF1CF69DEF371F1E28FC0F66AEE93CCF66
2768b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_4D6B3EB9FCF965ACEB905EECDEB080B1binary
MD5:F72AD05335D5586FE4D3F4FDF4C4AFA0
SHA256:C621B1001E7F207ACE6CE5C0446D033FF8E161C94AF75B661C8ACDE9C72FE319
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7yTSbUNi7CXXtef0luXqk%3D
US
der
279 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
1052
svchost.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDCpLyOwe8JNYnzhjuetFgf
US
der
472 b
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEA7j3xstfX1ZpOivr3r64cM%3D
US
der
280 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1052
svchost.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
104.20.22.46:443
nodejs.org
Cloudflare Inc
US
shared
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
104.31.93.244:443
up.jspixel.com
Cloudflare Inc
US
suspicious
2768
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
up.jspixel.com
  • 104.31.93.244
  • 104.31.92.244
  • 172.67.159.168
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
nodejs.org
  • 104.20.22.46
  • 104.20.23.46
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted

Threats

No threats detected
Process
Message
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b140231893c88c5d7f9697e5451ae17d69a94688d8fdf1cbe00c9d4794f34d17.exe