analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

201863026.exe

Full analysis: https://app.any.run/tasks/91c68807-1875-4704-9bec-e81f8c29edd4
Verdict: Malicious activity
Analysis date: October 05, 2022, 04:15:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

4EDAE0963083B83848397D9CD2590339

SHA1:

69F04732DE6963552B8BED4788B749CD94C38535

SHA256:

B71BE464184118450E43DACA8DD31345CC9A1C4789C172BC3688519BBE389ACA

SSDEEP:

3072:IfY/TU9fE9PEtuk/mDT9WvM2qy1KXlpHAyuTxv+frWtip0:+Ya6Cw9WPCHAyuT5+fq60

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 2416)
      • cmd.exe (PID: 3028)

    • Starts NET.EXE to view/change users localgroup

      • cmd.exe (PID: 2312)

  • SUSPICIOUS

    • Reads the computer name

      • 201863026.exe (PID: 2588)
      • msiexec.exe (PID: 2852)

    • Checks supported languages

      • 201863026.exe (PID: 2588)
      • cmd.exe (PID: 2356)
      • msiexec.exe (PID: 2852)
      • cmd.exe (PID: 2312)
      • cmd.exe (PID: 2416)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3028)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2356)

    • Starts CMD.EXE for commands execution

      • 201863026.exe (PID: 2588)

    • Reads the time zone

      • net1.exe (PID: 3972)

  • INFO

    • Reads the computer name

      • WMIC.exe (PID: 1420)
      • WMIC.exe (PID: 3692)
      • WMIC.exe (PID: 2160)
      • WMIC.exe (PID: 356)
      • WMIC.exe (PID: 3476)
      • WMIC.exe (PID: 2272)
      • WMIC.exe (PID: 3364)
      • WMIC.exe (PID: 2936)
      • WMIC.exe (PID: 1152)
      • WMIC.exe (PID: 3540)
      • WMIC.exe (PID: 2292)
      • net1.exe (PID: 3972)
      • net1.exe (PID: 3248)
      • net1.exe (PID: 2236)

    • Checks supported languages

      • WMIC.exe (PID: 3692)
      • WMIC.exe (PID: 1420)
      • WMIC.exe (PID: 2160)
      • WMIC.exe (PID: 3476)
      • WMIC.exe (PID: 2272)
      • WMIC.exe (PID: 356)
      • WMIC.exe (PID: 3364)
      • WMIC.exe (PID: 2936)
      • WMIC.exe (PID: 1152)
      • WMIC.exe (PID: 3540)
      • WMIC.exe (PID: 2292)
      • net1.exe (PID: 3972)
      • net1.exe (PID: 3248)
      • net.exe (PID: 4092)
      • net.exe (PID: 2044)
      • net.exe (PID: 2184)
      • net1.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2021-Sep-25 21:56:47
Detected languages:
  • English - United States

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 216

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2021-Sep-25 21:56:47
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
26230
26624
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41746
.rdata
32768
5018
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.14107
.data
40960
131960
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11058
.ndata
176128
65536
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
241664
43416
43520
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.75354

Resources

Title
Entropy
Size
Codepage
Language
Type
1
7.81232
41501
UNKNOWN
English - United States
RT_ICON
103
1.51664
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG
1 (#2)
5.28747
841
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
25
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 201863026.exe no specs 201863026.exe cmd.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs msiexec.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Users\admin\Desktop\201863026.exe" C:\Users\admin\Desktop\201863026.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2588"C:\Users\admin\Desktop\201863026.exe" C:\Users\admin\Desktop\201863026.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
2356C:\Windows\system32\cmd.exe /c information.batC:\Windows\system32\cmd.exe—201863026.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1420wmic OS get /format:hform C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3692wmic computersystem get /format:hform C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2160wmic service where state="running" get caption,name,pathname,state,status,acceptpause,acceptstop,processid,systemname,startname /format:htable C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3476wmic service where state="stopped" get caption,name,pathname,state,status,acceptpause,acceptstop,processid,systemname,startname /format:htable C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
356wmic csproduct list brief /format:htable C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2272wmic cpu list brief /format:htable C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3364wmic diskdrive list brief /format:htable C:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 051
Read events
1 043
Write events
8
Delete events
0

Modification events

(PID) Process:(2588) 201863026.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2588) 201863026.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2588) 201863026.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2588) 201863026.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
0
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
2356cmd.exeC:\Users\admin\Desktop\USER-PC.htmlhtml
MD5:2E198265CD2C35E1A8EE772DC1C28607
SHA256:FC0EA793B2CB5B798BFA1F03CEA44065779A9D63DE1B686FF85BACD5D517D9FC
2588201863026.exeC:\Temp\rand.JPGimage
MD5:41192B03351DE6DEA01FA56A4AE0D00B
SHA256:49EDD8FA85FB8A6B227B718EDF245CD8E6527457D4773206938F0C9C51562AB0
2588201863026.exeC:\Temp\winapply.battext
MD5:A9EDD79D0509E10A12F780A2064D7EEC
SHA256:0C9F0D0194FCDD44C9C11EC9F41F945B34D79F2BC9D605DA49493254B9829B8F
2588201863026.exeC:\Users\admin\AppData\Local\Temp\nsgCCC7.tmppcx
MD5:49017995B0F2B0E5A1E733F0649B0BE8
SHA256:22848E30D793BB8C7C493181DDA40BAF7EB668A21BF084354AE741D9F88348B2
2588201863026.exeC:\Users\admin\Desktop\loopfile.battext
MD5:62933B06A3D49DB78F36DFFDEBFBE48C
SHA256:D2F97B09462CC4863FA9D6CB8A0B0DCE035B45B7A1E2AE0F04DB63983EA383C2
3028cmd.exeC:\Users\admin\AppData\Local\Temp\info.txttext
MD5:12B47862DDAF9E0B1751A51A63C05887
SHA256:CD4E03ACB3F078230ADBEB8228058F8E12A3E768C0B83BEF9A6DBA00F6677DE3
2588201863026.exeC:\Users\admin\Desktop\b6 ransomware.battext
MD5:77CBC6B6A2865CF4C477DEB058E19936
SHA256:AB7E431B53A62CD2E01200160C37BD888AC0755FAB1DADE4ACCA72B229D1E2B7
2588201863026.exeC:\Users\admin\Desktop\information.battext
MD5:F3C20C9F6364A4356B80552657404953
SHA256:0BDB529F76A8E829F9080C39B4707E89F95F935C7126CB8614E3D16032B3C26F
2588201863026.exeC:\Temp\matrix.battext
MD5:0293000D86A840CCC8B3D975C5B3F1F0
SHA256:5FE0ACE5B36EAD6C3FC76C67C4751CC8AD568B4C8C86C1E01869E51AB46001E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce094ce09e444cff
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
201863026.exe