download:

apache-tomcat-7.0.99.exe

Full analysis: https://app.any.run/tasks/5df32b52-c7f8-43ef-9574-26c912b64ede
Verdict: Malicious activity
Analysis date: January 18, 2020, 19:23:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

EBC67901EC13CC4A6E34562E0870E2A1

SHA1:

A040F7C07A4367D6EFA828DC1BAA9895CE085597

SHA256:

B81B6D65248C43A8E66CD12ACD44C225B012FF340AB62E9FD71BAF8615A4CF0F

SSDEEP:

196608:WC+NaZbDijylfxGqqaJYYwlVcQt1rvWt173OGjZZV6GL7vnVcjH:kNaZb7JcYwvVt1rvWtdZf6A7vVcjH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Application was dropped or rewritten from another process

      • Tomcat7.exe (PID: 3900)
      • Tomcat7.exe (PID: 2684)
      • Tomcat7.exe (PID: 2800)
      • Tomcat7.exe (PID: 1016)
      • Tomcat7.exe (PID: 2724)
      • nsE0D8.tmp (PID: 3084)
      • Tomcat7.exe (PID: 688)
      • nsE92A.tmp (PID: 1152)
      • nsEA15.tmp (PID: 3656)
      • nsEA93.tmp (PID: 2188)
      • Tomcat7w.exe (PID: 1856)
      • nsE61A.tmp (PID: 3516)
      • nsE4C1.tmp (PID: 3132)
      • nsE6F5.tmp (PID: 1848)
      • nsE7D1.tmp (PID: 3832)

    • Changes the autorun value in the registry

      • apache-tomcat-7.0.99.exe (PID: 3912)

  • SUSPICIOUS

    • Creates files in the program directory

      • Tomcat7.exe (PID: 3900)
      • Tomcat7.exe (PID: 2724)
      • Tomcat7.exe (PID: 688)
      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Starts application with an unusual extension

      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Creates files in the user directory

      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Executable content was dropped or overwritten

      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Uses ICACLS.EXE to modify access control list

      • nsE92A.tmp (PID: 1152)
      • nsEA93.tmp (PID: 2188)
      • nsEA15.tmp (PID: 3656)

    • Creates a software uninstall entry

      • apache-tomcat-7.0.99.exe (PID: 3912)

    • Executed as Windows Service

      • Tomcat7.exe (PID: 688)

    • Creates files in the Windows directory

      • Tomcat7.exe (PID: 688)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 1752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 23:24:32+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x3328
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.0.99.0
ProductVersionNumber: 7.0.99.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: tomcat.apache.org
CompanyName: Apache Software Foundation
FileDescription: Apache Tomcat Installer
FileVersion: 2
InternalName: apache-tomcat-7.0.99.exe
LegalCopyright: Copyright (c) 1999-2019 The Apache Software Foundation
ProductName: Apache Tomcat
ProductVersion: 7.0.99

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:24:32
Detected languages:
  • English - United States
Comments: tomcat.apache.org
CompanyName: Apache Software Foundation
FileDescription: Apache Tomcat Installer
FileVersion: 2.0
InternalName: apache-tomcat-7.0.99.exe
LegalCopyright: Copyright (c) 1999-2019 The Apache Software Foundation
ProductName: Apache Tomcat
ProductVersion: 7.0.99

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:24:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006077
0x00006200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.40386
.rdata
0x00008000
0x00001250
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04481
.data
0x0000A000
0x0001A838
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.22445
.ndata
0x00025000
0x0001D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00042000
0x00006D98
0x00006E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.38329

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28794
1070
UNKNOWN
English - United States
RT_MANIFEST
2
3.58585
3752
UNKNOWN
English - United States
RT_ICON
3
4.1463
3240
UNKNOWN
English - United States
RT_ICON
4
3.71606
2216
UNKNOWN
English - United States
RT_ICON
5
2.64646
1640
UNKNOWN
English - United States
RT_ICON
6
2.71436
1384
UNKNOWN
English - United States
RT_ICON
7
4.23914
872
UNKNOWN
English - United States
RT_ICON
8
2.95894
744
UNKNOWN
English - United States
RT_ICON
9
2.78721
296
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
22
Malicious processes
2
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start start apache-tomcat-7.0.99.exe nse0d8.tmp no specs tomcat7.exe no specs explorer.exe no specs nse4c1.tmp no specs tomcat7.exe no specs nse61a.tmp no specs tomcat7.exe no specs nse6f5.tmp no specs tomcat7.exe no specs nse7d1.tmp no specs tomcat7.exe no specs nse92a.tmp no specs icacls.exe no specs nsea15.tmp no specs icacls.exe no specs nsea93.tmp no specs icacls.exe no specs tomcat7w.exe no specs notepad.exe no specs tomcat7.exe no specs apache-tomcat-7.0.99.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
688"C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe" //RS//Tomcat7C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe—services.exe
User:
LOCAL SERVICE
Company:
Apache Software Foundation
Integrity Level:
SYSTEM
Description:
Apache Commons Daemon Service Runner
Exit code:
0
Version:
1.2.2.0
Modules
Images
c:\program files\apache software foundation\tomcat 7.0\bin\tomcat7.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1016"C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe" //US//Tomcat7 --Classpath "C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\bootstrap.jar;C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\tomcat-juli.jar" --StartClass org.apache.catalina.startup.Bootstrap --StopClass org.apache.catalina.startup.Bootstrap --StartParams start --StopParams stop --StartMode jvm --StopMode jvmC:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe—nsE4C1.tmp
User:
admin
Company:
Apache Software Foundation
Integrity Level:
HIGH
Description:
Apache Commons Daemon Service Runner
Exit code:
0
Version:
1.2.2.0
Modules
Images
c:\program files\apache software foundation\tomcat 7.0\bin\tomcat7.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1152"C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsE92A.tmp" icacls "C:\Program Files\Apache Software Foundation\Tomcat 7.0" /inheritance:r /grant *S-1-5-19:(OI)(CI)(F) /grant *S-1-5-32-544:(OI)(CI)(F) /grant *S-1-5-18:(OI)(CI)(F)C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsE92A.tmp—apache-tomcat-7.0.99.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqba54.tmp\nse92a.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1752"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1848"C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsE6F5.tmp" "C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe" //US//Tomcat7 --JvmOptions9 "--add-opens=java.base/java.lang=ALL-UNNAMED#--add-opens=java.base/java.io=ALL-UNNAMED#--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsE6F5.tmp—apache-tomcat-7.0.99.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqba54.tmp\nse6f5.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1856"C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe" //MR//Tomcat7C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7w.exe—apache-tomcat-7.0.99.exe
User:
admin
Company:
Apache Software Foundation
Integrity Level:
HIGH
Description:
Apache Commons Daemon Service Manager
Exit code:
0
Version:
1.2.2.0
Modules
Images
c:\program files\apache software foundation\tomcat 7.0\bin\tomcat7w.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2068"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Apache Software Foundation\Tomcat 7.0\webapps\ROOT\RELEASE-NOTES.txtC:\Windows\system32\NOTEPAD.EXE—apache-tomcat-7.0.99.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2120"C:\Users\admin\AppData\Local\Temp\apache-tomcat-7.0.99.exe" C:\Users\admin\AppData\Local\Temp\apache-tomcat-7.0.99.exe—explorer.exe
User:
admin
Company:
Apache Software Foundation
Integrity Level:
MEDIUM
Description:
Apache Tomcat Installer
Exit code:
3221226540
Version:
2.0
Modules
Images
c:\users\admin\appdata\local\temp\apache-tomcat-7.0.99.exe
c:\systemroot\system32\ntdll.dll
2188"C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsEA93.tmp" icacls "C:\Program Files\Apache Software Foundation\Tomcat 7.0\Uninstall.exe" /inheritance:e /grant *S-1-5-11:(RX)C:\Users\admin\AppData\Local\Temp\nsqBA54.tmp\nsEA93.tmp—apache-tomcat-7.0.99.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqba54.tmp\nsea93.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2516icacls "C:\Program Files\Apache Software Foundation\Tomcat 7.0\tomcat.ico" /inheritance:e /grant *S-1-5-11:(R)C:\Windows\system32\icacls.exe—nsEA15.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
Total events
426
Read events
393
Write events
33
Delete events
0

Modification events

(PID) Process:(3900) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Java
Operation:writeName:Jvm
Value:
C:\Program Files\Java\jre1.8.0_92\bin\client\jvm.dll
(PID) Process:(3900) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Stop
Operation:writeName:WorkingPath
Value:
C:\Program Files\Apache Software Foundation\Tomcat 7.0
(PID) Process:(3900) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Start
Operation:writeName:WorkingPath
Value:
C:\Program Files\Apache Software Foundation\Tomcat 7.0
(PID) Process:(3900) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Log
Operation:writeName:Path
Value:
C:\Program Files\Apache Software Foundation\Tomcat 7.0\logs
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Java
Operation:writeName:Classpath
Value:
C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\bootstrap.jar;C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\tomcat-juli.jar
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Stop
Operation:writeName:Class
Value:
org.apache.catalina.startup.Bootstrap
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Stop
Operation:writeName:Params
Value:
stop
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Stop
Operation:writeName:Mode
Value:
jvm
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Start
Operation:writeName:Class
Value:
org.apache.catalina.startup.Bootstrap
(PID) Process:(1016) Tomcat7.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Apache Software Foundation\Procrun 2.0\Tomcat7\Parameters\Start
Operation:writeName:Params
Value:
start
Executable files
37
Suspicious files
2
Text files
190
Unknown types
9

Dropped files

PID
Process
Filename
Type
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\catalina-tribes.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\catalina-ha.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\servlet-api.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\annotations-api.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\catalina-ant.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\RELEASE-NOTEStext
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\jasper-el.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\catalina.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\jsp-api.jarjava
MD5:—
SHA256:—
3912apache-tomcat-7.0.99.exeC:\Program Files\Apache Software Foundation\Tomcat 7.0\lib\el-api.jarjava
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
apache-tomcat-7.0.99.exe