analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

3ca3579e3a2a66f494bcb72adc576482.bat

Full analysis: https://app.any.run/tasks/549e0ea6-eeb8-43a8-9ada-fb09488bb8a6
Verdict: Malicious activity
Analysis date: November 15, 2018, 11:21:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2978B9AF6D7985ECBEEDF8E3CBC5F6F3

SHA1:

58D74DA45259396B1E43A10B6736C5CA7443ACC4

SHA256:

BFF1B31DF5D7BD5DA7F80E84D094AFC34A4E96BB08DDC5D37483C145700D91C3

SSDEEP:

12288:/UBgyoyvf7UziRXlQM9nH541EeIccPniD1kR/XlQM9nH541EeIccPniD1kR1:/UXvf7OQVQ4nZaEj+kR/VQ4nZaEj+kR1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 1.exe (PID: 3280)
      • 2.bat (PID: 3836)
      • 1.exe (PID: 2812)
      • 2.bat (PID: 2792)
      • syswin32.exe (PID: 3824)
      • syswin32.exe (PID: 3212)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 3144)
      • 2.bat (PID: 3836)

    • Executable content was dropped or overwritten

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 3144)
      • 2.bat (PID: 2792)

    • Suspicious files were dropped or overwritten

      • 3ca3579e3a2a66f494bcb72adc576482.bat (PID: 3144)

    • Starts Internet Explorer

      • 2.bat (PID: 2792)
      • 1.exe (PID: 2812)

    • Application launched itself

      • syswin32.exe (PID: 3824)
      • taskmgr.exe (PID: 3460)

    • Loads DLL from Mozilla Firefox

      • syswin32.exe (PID: 3212)

    • Creates files in the user directory

      • 2.bat (PID: 2792)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 3384)

  • INFO

    • Application was crashed

      • iexplore.exe (PID: 2552)

    • Creates files in the user directory

      • iexplore.exe (PID: 2540)

    • Connects to unusual port

      • iexplore.exe (PID: 2540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0xfce7
UninitializedDataSize: -
InitializedDataSize: 250880
CodeSize: 135168
LinkerVersion: 14
PEType: PE32
TimeStamp: 2016:08:14 21:15:54+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Aug-2016 19:15:54
Detected languages:
  • Polish - Poland
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 14-Aug-2016 19:15:54
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00020F77
0x00021000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62162
.rdata
0x00022000
0x00008FD4
0x00009000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13549
.data
0x0002B000
0x0002D370
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.7652
.gfids
0x00059000
0x000000FC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.16316
.rsrc
0x0005A000
0x0000483D
0x00004A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.69159
.reloc
0x0005F000
0x00002354
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.69514

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28823
1873
UNKNOWN
Polish - Poland
RT_MANIFEST
7
3.41798
548
UNKNOWN
Polish - Poland
RT_STRING
8
3.45553
572
UNKNOWN
Polish - Poland
RT_STRING
9
3.47114
492
UNKNOWN
Polish - Poland
RT_STRING
10
3.40584
320
UNKNOWN
Polish - Poland
RT_STRING
11
3.53928
1216
UNKNOWN
Polish - Poland
RT_STRING
12
3.32935
368
UNKNOWN
Polish - Poland
RT_STRING
13
3.23901
300
UNKNOWN
Polish - Poland
RT_STRING
14
3.15623
264
UNKNOWN
Polish - Poland
RT_STRING
15
3.15753
232
UNKNOWN
Polish - Poland
RT_STRING

Imports

COMCTL32.dll (delay-loaded)
KERNEL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
13
Malicious processes
2
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start 3ca3579e3a2a66f494bcb72adc576482.bat 1.exe no specs 2.bat no specs 2.bat 1.exe no specs iexplore.exe iexplore.exe syswin32.exe no specs syswin32.exe no specs taskmgr.exe no specs taskmgr.exe cmd.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3144"C:\Users\admin\AppData\Local\Temp\3ca3579e3a2a66f494bcb72adc576482.bat" C:\Users\admin\AppData\Local\Temp\3ca3579e3a2a66f494bcb72adc576482.bat
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3280"C:\Users\admin\AppData\Local\Temp\1.exe" C:\Users\admin\AppData\Local\Temp\1.exe—3ca3579e3a2a66f494bcb72adc576482.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3836"C:\Users\admin\AppData\Local\Temp\2.bat" C:\Users\admin\AppData\Local\Temp\2.bat—3ca3579e3a2a66f494bcb72adc576482.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2792"C:\Users\admin\AppData\Local\Temp\2.bat"C:\Users\admin\AppData\Local\Temp\2.bat
2.bat
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2812"C:\Users\admin\AppData\Local\Temp\1.exe"C:\Users\admin\AppData\Local\Temp\1.exe—1.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
2552"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
2.bat
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2540"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3824"C:\Users\admin\AppData\Roaming\install\syswin32.exe" C:\Users\admin\AppData\Roaming\install\syswin32.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3212"C:\Users\admin\AppData\Roaming\install\syswin32.exe"C:\Users\admin\AppData\Roaming\install\syswin32.exe—syswin32.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
3460"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 122
Read events
1 095
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
2
Text files
1 593
Unknown types
0

Dropped files

PID
Process
Filename
Type
2540iexplore.exeC:\Users\admin\AppData\Local\Temp\XxX.xXxtext
MD5:CA44589E0DB5C7FCC80F8CF5A20C79B5
SHA256:E264C9EDB900B2FF69972520B91FFA96355F7236DAD3EF40988E819D525C18D4
2540iexplore.exeC:\Users\admin\AppData\Local\Temp\UuU.uUutext
MD5:CA44589E0DB5C7FCC80F8CF5A20C79B5
SHA256:E264C9EDB900B2FF69972520B91FFA96355F7236DAD3EF40988E819D525C18D4
28121.exeC:\Users\admin\AppData\Local\Temp\XX--XX--XX.txtbinary
MD5:1D714CF0C3C9E707635EA67BEB8890BD
SHA256:8AB3678871BF90FBD13C066EA8521F14D9316144665016B568C41C4D1DBB7D57
27922.batC:\Users\admin\AppData\Roaming\install\syswin32.exeexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
27922.batC:\Users\admin\AppData\Local\Temp\XX--XX--XX.txtbinary
MD5:1D714CF0C3C9E707635EA67BEB8890BD
SHA256:8AB3678871BF90FBD13C066EA8521F14D9316144665016B568C41C4D1DBB7D57
31443ca3579e3a2a66f494bcb72adc576482.batC:\Users\admin\AppData\Local\Temp\1.exeexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
31443ca3579e3a2a66f494bcb72adc576482.batC:\Users\admin\AppData\Local\Temp\2.batexecutable
MD5:55D58F0D296D1E19F2E0BC966B422EE7
SHA256:9189925021567B3C399B409F53F4204BFB08FDE76FE8E50C6DD1684FB56A293B
3212syswin32.exeC:\Users\admin\AppData\Local\Temp\IEWEB.abctext
MD5:9E2FBAF6FAE8C687AA4E519EED2CFEC9
SHA256:54F5A85E392B1498DC1D9E8E9E7D685237CBD33320593AEBFEC706D3F6F1CAA1
2540iexplore.exeC:\Users\admin\AppData\Roaming\logs.dattext
MD5:BF3DBA41023802CF6D3F8C5FD683A0C7
SHA256:4A8E75390856BF822F492F7F605CA0C21F1905172F6D3EF610162533C140507D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2540
iexplore.exe
217.173.4.252:3300
123host.zapto.org
Przedsiebiorstwo PROMAX Spolka Jawna Zofia Formanek-Okroj, Wieslaw Okroj
PL
unknown

DNS requests

Domain
IP
Reputation
123host.zapto.org
  • 217.173.4.252
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
3ca3579e3a2a66f494bcb72adc576482.bat