File name: | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387 |
Full analysis: | https://app.any.run/tasks/e97416d5-93f9-4c94-a1b4-a010f9734103 |
Verdict: | Malicious activity |
Analysis date: | October 05, 2022, 03:55:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | CFA482B23FA7A59641A6B816D56A3C58 |
SHA1: | 0CD9753113E29FD460DCDCFFB21F364B3C5A14AA |
SHA256: | BA87D97A4C7DEC4E2EEF997190F5F875C8564395BF3C95BD95055F447C495387 |
SSDEEP: | 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DhKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWMKrKe |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2019-Oct-31 06:08:40 |
Detected languages: |
|
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 272 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2019-Oct-31 06:08:40 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 469942 | 470016 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.54453 |
.rdata | 475136 | 175538 | 175616 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.69449 |
.data | 651264 | 19304 | 14848 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.77903 |
.rsrc | 671744 | 480 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.70824 |
.reloc | 675840 | 23164 | 23552 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.56882 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.91161 | 381 | UNKNOWN | English - United States | RT_MANIFEST |
ADVAPI32.dll |
CRYPT32.dll |
IPHLPAPI.DLL |
KERNEL32.dll |
MPR.dll |
NETAPI32.dll |
OLEAUT32.dll |
RstrtMgr.DLL |
SHELL32.dll |
WS2_32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
684 | "C:\Users\admin\Desktop\ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe" | C:\Users\admin\Desktop\ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
4072 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\system32\DllHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1784 | "C:\Users\admin\Desktop\ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe" | C:\Users\admin\Desktop\ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | — | DllHost.exe | |||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
2436 | vssadmin.exe Delete Shadows /All /Quiet | C:\Windows\system32\vssadmin.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2896 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2348 | bcdedit.exe /set {default} recoveryenabled No | C:\Windows\system32\bcdedit.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3604 | bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures | C:\Windows\system32\bcdedit.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3880 | wbadmin DELETE SYSTEMSTATEBACKUP | C:\Windows\system32\wbadmin.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® BLB Backup Exit code: 4294967293 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2316 | wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest | C:\Windows\system32\wbadmin.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® BLB Backup Exit code: 4294967293 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3956 | wmic.exe SHADOWCOPY /nointeractive | C:\Windows\System32\Wbem\wmic.exe | — | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Exit code: 44124 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
1532 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl | etl | |
MD5:B66406565290C416889900BF58CA3B2B | SHA256:E92288218277CB79F7E019CFA2B42821243A35B56455249A58DC3150C33FAD40 | |||
2316 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl | etl | |
MD5:B66406565290C416889900BF58CA3B2B | SHA256:E92288218277CB79F7E019CFA2B42821243A35B56455249A58DC3150C33FAD40 | |||
1784 | ba87d97a4c7dec4e2eef997190f5f875c8564395bf3c95bd95055f447c495387.exe | C:\Users\admin\AppData\Roaming\svhost.exe | executable | |
MD5:CFA482B23FA7A59641A6B816D56A3C58 | SHA256:BA87D97A4C7DEC4E2EEF997190F5F875C8564395BF3C95BD95055F447C495387 | |||
1532 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl | etl | |
MD5:226B66C5F5579D87C8A73ABC94E9A5CB | SHA256:4414E707D251DD775F06239860FADE1DF28B3325351735D313DEA8DED1906FC1 | |||
2448 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.0.etl | etl | |
MD5:D3C5937655D5903174244FC37CF1724D | SHA256:4ECB65BF1D63231674D154A5BC82C05544C25E67AB41AC34C906830D7059BB2F | |||
3880 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl | etl | |
MD5:B66406565290C416889900BF58CA3B2B | SHA256:E92288218277CB79F7E019CFA2B42821243A35B56455249A58DC3150C33FAD40 | |||
3880 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.0.etl | etl | |
MD5:B66406565290C416889900BF58CA3B2B | SHA256:E92288218277CB79F7E019CFA2B42821243A35B56455249A58DC3150C33FAD40 | |||
2316 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.0.etl | etl | |
MD5:908A070D9018016670EBE8FE6B48399D | SHA256:1DA1B43F7A92972912A90F43EED15D0A19DBD366DD17F7564AE3D232E1C4F675 | |||
3820 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.0.etl | etl | |
MD5:846020E47DB010033B711540844CD889 | SHA256:56E6DEF56CFBD5B50D3C6BE920B35EC386B2EA193230CCFC8BEAEFA6DAD7DB7D | |||
2448 | wbadmin.exe | C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl | etl | |
MD5:226B66C5F5579D87C8A73ABC94E9A5CB | SHA256:4414E707D251DD775F06239860FADE1DF28B3325351735D313DEA8DED1906FC1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 9.90 Kb | whitelisted |
924 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | — | — | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 7.06 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 5.78 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 21.1 Kb | whitelisted |
1744 | chrome.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | crx | 242 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 43.6 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 19.9 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 9.90 Kb | whitelisted |
924 | svchost.exe | GET | 206 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APhHMzuprJvS7ixvnAk_gdI_1/anGnv31dmOJhheXBnYQ3gw | US | binary | 178 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 192.168.100.2:445 | — | — | — | whitelisted |
— | — | 192.168.100.2:139 | — | — | — | whitelisted |
1744 | chrome.exe | 142.250.186.35:443 | clientservices.googleapis.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 142.250.186.142:443 | clients2.google.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 142.250.185.225:443 | clients2.googleusercontent.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 34.104.35.123:80 | edgedl.me.gvt1.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 216.58.212.141:443 | accounts.google.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 172.217.169.163:443 | update.googleapis.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 142.250.187.131:443 | ssl.gstatic.com | GOOGLE | US | whitelisted |
1744 | chrome.exe | 142.250.187.142:443 | clients1.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
clients2.google.com |
| whitelisted |
accounts.google.com |
| shared |
clients2.googleusercontent.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
update.googleapis.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
edgedl.me.gvt1.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
clients1.google.com |
| whitelisted |