| File name: | Ground.exe |
| Full analysis: | https://app.any.run/tasks/0687594a-e5ee-45aa-82cc-5e0b7e5f6200 |
| Verdict: | Malicious activity |
| Analysis date: | November 20, 2023, 06:32:18 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E838F53B2A7DD58BC2DBE4988009A125 |
| SHA1: | 002E41BBC5A477E0BE8D5C2B3183A24DF4E579B3 |
| SHA256: | B461B2FF99979370236584A70FA3C602099DF0D013FDD863CBB4D72FC04132AA |
| SSDEEP: | 12288:xltfL7HcV/td/EMPMtoMeU592ZmxeZZ+2Rf0i4VX7DJ5rSu3VUSVUH2I:xltf3cV3/NPNBNoLDfrSu3VUSVUHj |
MALICIOUS
Drops the executable file immediately after the start
- Ground.exe (PID: 3128)
Create files in the Startup directory
- Ground.exe (PID: 4056)
SUSPICIOUS
No suspicious indicators.INFO
Creates files or folders in the user directory
- Ground.exe (PID: 3128)
- Ground.exe (PID: 4056)
Reads the computer name
- Ground.exe (PID: 3128)
- Ground.exe (PID: 4056)
Checks supported languages
- Ground.exe (PID: 3128)
- Ground.exe (PID: 4056)
Manual execution by a user
- explorer.exe (PID: 3308)
- Ground.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Delphi generic (31.9) |
|---|---|---|
| .scr | | | Windows screen saver (29.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (14.8) |
| .exe | | | Win32 Executable (generic) (10.1) |
| .exe | | | Win16/32 Executable Delphi generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2011:08:26 11:37:40+02:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 461824 |
| InitializedDataSize: | 71168 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x72814 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
38
Monitored processes
3
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3128 | "C:\Users\admin\AppData\Local\Temp\Ground.exe" | C:\Users\admin\AppData\Local\Temp\Ground.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3308 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4056 | "C:\Users\admin\AppData\Roaming\Ground.exe" | C:\Users\admin\AppData\Roaming\Ground.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
834
Read events
834
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3128 | Ground.exe | C:\Users\admin\AppData\Roaming\Ground.exe | executable | |
MD5:E838F53B2A7DD58BC2DBE4988009A125 | SHA256:B461B2FF99979370236584A70FA3C602099DF0D013FDD863CBB4D72FC04132AA | |||
| 4056 | Ground.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ground.lnk | binary | |
MD5:E907EF8BB2A064BA9DDAF6AB0BD91927 | SHA256:2854279476AF9A7001281A13BA27B28EA1037642F27AFA901E2061539CBAAEEA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |