File name: | MBRLock_Builder.exe |
Full analysis: | https://app.any.run/tasks/a42c6a11-1cbc-4704-b23c-9e0cf2d49f43 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 07:58:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | C8F5F007E75F79D7289568406B450A21 |
SHA1: | 424232CD270B7E7D255D440D25188097B9F0E465 |
SHA256: | BE0830713D84EBE82E0FD2A9380D4E4FBA59B547691A14069EA024C8562396D4 |
SSDEEP: | 3072:9PdEbA9i6ZUVXMdvx4JVAKvj62QvOOi2RW8F1CaDNmS4dZbAX/qcNOG+xD9VtxZP:VdE89ZU+dvIfXI3XCaDWZbA0Frt |
.exe | | | UPX compressed Win32 Executable (38.2) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (37.5) |
.dll | | | Win32 Dynamic Link Library (generic) (9.2) |
.exe | | | Win32 Executable (generic) (6.3) |
.exe | | | Win16/32 Executable Delphi generic (2.9) |
ProductVersion: | 0.2.0.0 |
---|---|
ProductName: | [MBRLocker Builder] |
OriginalFileName: | - |
LegalTrademarks: | - |
LegalCopyright: | Copyrights damned! |
InternalName: | - |
FileVersion: | 0.2.0.0 |
FileDescription: | [MBRLocker Builder] |
CompanyName: | VaZoNeZ Corp. |
CharacterSet: | Windows, Cyrillic |
LanguageCode: | Russian |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 0.2.0.0 |
FileVersionNumber: | 0.2.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x7b180 |
UninitializedDataSize: | 323584 |
InitializedDataSize: | 20480 |
CodeSize: | 180224 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
TimeStamp: | 1992:06:19 22:22:17+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 19-Jun-1992 22:22:17 |
Detected languages: |
|
CompanyName: | VaZoNeZ Corp. |
FileDescription: | [MBRLocker Builder] |
FileVersion: | 0.2.0.0 |
InternalName: | - |
LegalCopyright: | Copyrights damned! |
LegalTrademarks: | - |
OriginalFilename: | - |
ProductName: | [MBRLocker Builder] |
ProductVersion: | 0.2.0.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0050 |
Pages in file: | 0x0002 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x000F |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x001A |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000100 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 19-Jun-1992 22:22:17 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x0004F000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x00050000 | 0x0002C000 | 0x0002B400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.91763 |
.rsrc | 0x0007C000 | 0x00005000 | 0x00004A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.7989 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.95218 | 581 | UNKNOWN | UNKNOWN | RT_MANIFEST |
2 | 4.85896 | 4264 | UNKNOWN | Russian - Russia | RT_ICON |
3 | 4.85951 | 1128 | UNKNOWN | Russian - Russia | RT_ICON |
4 | 7.13784 | 308 | UNKNOWN | UNKNOWN | RT_CURSOR |
5 | 7.3672 | 308 | UNKNOWN | UNKNOWN | RT_CURSOR |
6 | 7.26555 | 308 | UNKNOWN | UNKNOWN | RT_CURSOR |
7 | 7.2129 | 308 | UNKNOWN | UNKNOWN | RT_CURSOR |
4084 | 7.56726 | 584 | UNKNOWN | UNKNOWN | RT_STRING |
4085 | 7.53912 | 504 | UNKNOWN | UNKNOWN | RT_STRING |
4086 | 6.93386 | 204 | UNKNOWN | UNKNOWN | RT_STRING |
KERNEL32.DLL |
advapi32.dll |
comctl32.dll |
comdlg32.dll |
gdi32.dll |
oleaut32.dll |
user32.dll |
version.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2672 | "C:\Users\admin\AppData\Local\Temp\MBRLock_Builder.exe" | C:\Users\admin\AppData\Local\Temp\MBRLock_Builder.exe | explorer.exe | ||||||||||||
User: admin Company: VaZoNeZ Corp. Integrity Level: MEDIUM Description: [MBRLocker Builder] Exit code: 1073807364 Version: 0.2.0.0 Modules
| |||||||||||||||
2068 | "C:\Users\admin\Desktop\mbr-locker.exe" | C:\Users\admin\Desktop\mbr-locker.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1073807364 Modules
| |||||||||||||||
580 | "C:\Users\admin\Desktop\mbr-locker.exe" | C:\Users\admin\Desktop\mbr-locker.exe | mbr-locker.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
2452 | C:\Users\admin\AppData\Local\Temp\\sys3.exe | C:\Users\admin\AppData\Local\Temp\sys3.exe | — | mbr-locker.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
|
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
Operation: | write | Name: | NodeSlots |
Value: 0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202 | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
Operation: | write | Name: | MRUListEx |
Value: 0C000000000000000B00000001000000020000000D00000007000000060000000A0000000900000008000000030000000500000004000000FFFFFFFF | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
Operation: | write | Name: | MRUListEx |
Value: 020000000C000000000000000B000000010000000D00000007000000060000000A0000000900000008000000030000000500000004000000FFFFFFFF | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlgLegacy |
Operation: | write | Name: | TV_FolderType |
Value: {FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlgLegacy |
Operation: | write | Name: | TV_TopViewID |
Value: {82BA0782-5B7A-4569-B5D7-EC83085F08CC} | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlgLegacy |
Operation: | write | Name: | TV_TopViewVersion |
Value: 0 | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
Operation: | write | Name: | Mode |
Value: 4 | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
Operation: | write | Name: | LogicalViewMode |
Value: 1 | |||
(PID) Process: | (2672) MBRLock_Builder.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} |
Operation: | write | Name: | FFlags |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2672 | MBRLock_Builder.exe | C:\Users\admin\Desktop\mbr-locker.exe | executable | |
MD5:EB75B82594C69AFEA0FE8163168376EC | SHA256:858DAA3B7FD3F2925B5ECC41D770267A695447D9FA0AA39568CF34F96EDC94AD | |||
580 | mbr-locker.exe | C:\Users\admin\AppData\Local\Temp\sys3.exe | executable | |
MD5:EB75B82594C69AFEA0FE8163168376EC | SHA256:858DAA3B7FD3F2925B5ECC41D770267A695447D9FA0AA39568CF34F96EDC94AD | |||
580 | mbr-locker.exe | C:\Users\admin\AppData\Local\Temp\systm.txt | text | |
MD5:29ED657519A929C905BE0FFD9A0EEC7F | SHA256:1712270CC9D3BDE3298E49A514773C98B32F5F5A7CE447B662369B570AF27F32 |