analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

607c020ccd8e87bd7fd91dab66479fe0.exe

Full analysis: https://app.any.run/tasks/234ea5a2-9e49-4950-a73a-fd0709d43193
Verdict: Malicious activity
Analysis date: December 04, 2023, 11:37:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

607C020CCD8E87BD7FD91DAB66479FE0

SHA1:

21002F1D6D8F026CDA8AB2C4001EEED6E981B330

SHA256:

B58D7685ECCA1A16F4702A50E623B41CA47422AA9CE3781FE422E752EC52B76B

SSDEEP:

12288:5V5lAvYHb82Mx2YXVR8nLo20llVSZr5utkY9yKwrjr:5VPAvYHb82MAYXVKnLohl/SZdutkY9yL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Reads security settings of Internet Explorer

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Reads Microsoft Outlook installation path

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Reads the Internet Settings

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Checks Windows Trust Settings

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Reads Internet Explorer settings

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

  • INFO

    • Checks supported languages

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2544)

    • Checks proxy server information

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Reads the computer name

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2544)

    • Reads the machine GUID from the registry

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Create files in a temporary directory

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2544)

    • Creates files or folders in the user directory

      • 607c020ccd8e87bd7fd91dab66479fe0.exe (PID: 2644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (38.2)
.exe | Win32 EXE Yoda's Crypter (37.5)
.dll | Win32 Dynamic Link Library (generic) (9.2)
.exe | Win32 Executable (generic) (6.3)
.exe | Win16/32 Executable Delphi generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 364544
InitializedDataSize: 8192
UninitializedDataSize: 921600
EntryPoint: 0x13aaf0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.8.0.0
ProductVersionNumber: 3.8.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Chinese (Simplified)
CompanyName: 桂林老兵站
FileDescription: 网站安全检测工具
FileVersion: 3.8.0.0
InternalName: 桂林老兵站
LegalCopyright: www.gxgl.com&www.gxgl.net
LegalTrademarks: -
OriginalFileName: -
ProductName: WebTool
ProductVersion: 3.8.0.0
Comments: 主要用于网站的安全检测。
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 607c020ccd8e87bd7fd91dab66479fe0.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2644"C:\Users\admin\AppData\Local\Temp\607c020ccd8e87bd7fd91dab66479fe0.exe" C:\Users\admin\AppData\Local\Temp\607c020ccd8e87bd7fd91dab66479fe0.exe
explorer.exe
User:
admin
Company:
桂林老兵站
Integrity Level:
MEDIUM
Description:
网站安全检测工具
Version:
3.8.0.0
Modules
Images
c:\users\admin\appdata\local\temp\607c020ccd8e87bd7fd91dab66479fe0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
2544"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 585
Read events
10 555
Write events
29
Delete events
1

Modification events

(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(2644) 607c020ccd8e87bd7fd91dab66479fe0.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecision
Value:
0
Executable files
0
Suspicious files
13
Text files
62
Unknown types
1

Dropped files

PID
Process
Filename
Type
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_D855A42D6DB34DB801FA37B51C1634EFbinary
MD5:21FD6EC075D114602F022BF3C2301A63
SHA256:DFBBD58692A7CC0105DA55D3883FB0DFCE10C79C93DA6F4EDDD7595A92C14DA7
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\K45H2X8L.txttext
MD5:73FB4ADFA0F60B3AFCADF2878AF88EBC
SHA256:63834755B6D84361A39806917204EBFFE48DC4DA9A01D29503744C1B92557D01
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:C6DE5238E22DC528C1A4D14DDFF90764
SHA256:6386BC1692827128A46C01B954EBF2D5C2300987F0F1B2E0FC024FA27CB1D264
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AEE5C9ECC4575D7E763812597D10FF99
SHA256:AA003FC0C3B6DADFE2C98EAA67A61F49E51D357BEDE521B90C78EA0C634CA684
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5D01960BFB443A039A24C10C568C4F2C
SHA256:46D6019043089190D69E15DBADF4D7512D22E340A6791B4C87C449E20A1D967D
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317binary
MD5:030ECDE6BAE2A89FF5F53E4F1E6102F8
SHA256:CB8ED24CF106108D4EE05549F8DB94CEB623DFCF6BF98AADE1031837CB95B0B5
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\MYVHLMBP.txttext
MD5:9B148E863D73FCDA00E7B4948F75A667
SHA256:C08A04FFB96DF963E32018C2D5A995A529D935862D57A39221F3554F6F6CAD1C
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\2VRSUH11.txttext
MD5:68F1BBB99314E509D66F581D74A5ED3F
SHA256:A71963E183BECB7BE489B0485FCBAADED6BCFC2F6B912F21F2D89977454E3B96
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2644607c020ccd8e87bd7fd91dab66479fe0.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:264599C2F0E79D712D78E3B7AB1EDA7D
SHA256:0F11C0F75D737B2BAEF6701380166BCA719CA189C4F54495F92999161C416643
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
29
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
302
23.206.208.172:80
http://news.naver.com/
unknown
—
—
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
301
223.130.200.104:80
http://naver.com/
unknown
html
162 b
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
301
142.250.186.46:80
http://google.com/
unknown
html
219 b
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
302
172.217.18.100:80
http://www.google.com/
unknown
html
231 b
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
302
23.206.208.172:80
http://news.naver.com/
unknown
—
—
—
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c21afaf42e4512af
unknown
compressed
65.2 Kb
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c6d67f3a233f651e
unknown
compressed
4.66 Kb
—
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
GET
200
23.206.208.172:80
http://www.naver.com/
unknown
html
3.56 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
142.250.186.46:80
google.com
GOOGLE
US
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
172.217.18.100:80
www.google.com
GOOGLE
US
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
172.217.18.100:443
www.google.com
GOOGLE
US
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
142.250.186.163:80
ocsp.pki.goog
GOOGLE
US
unknown
2644
607c020ccd8e87bd7fd91dab66479fe0.exe
142.250.184.206:443
clients1.google.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
unknown
www.google.com
  • 172.217.18.100
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.pki.goog
  • 142.250.186.163
unknown
clients1.google.com
  • 142.250.184.206
unknown
news.naver.com
  • 23.206.208.172
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
naver.com
  • 223.130.200.104
  • 223.130.195.200
  • 223.130.195.95
  • 223.130.200.107
unknown
www.naver.com
  • 23.206.208.172
unknown
ssl.pstatic.net
  • 23.218.208.184
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
607c020ccd8e87bd7fd91dab66479fe0.exe