| File name: | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825 |
| Full analysis: | https://app.any.run/tasks/265554be-9d4a-4e99-add2-8f9d96e1f035 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | August 28, 2024, 06:44:48 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows |
| MD5: | 3F167A4CB8B366843FC3547F7F564FA4 |
| SHA1: | 20A3B47C2415856FD9FF8D8A61B376C85F6C6B52 |
| SHA256: | C3C1338EAA4025E765E84B85E277ED5A319A7D732FF2054B67ABA83578386825 |
| SSDEEP: | 12288:+cP5lUdwNtuHXqcn2388BZ9S1Equp2+YF4pMlJ:+cP5lUdwNtuHXqcj8BOyqup2+YapMlJ |
| .exe | | | Win64 Executable (generic) (87.2) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 0000:00:00 00:00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Large address aware, No debug |
| PEType: | PE32+ |
| LinkerVersion: | 2.34 |
| CodeSize: | 8704 |
| InitializedDataSize: | 294912 |
| UninitializedDataSize: | 2560 |
| EntryPoint: | 0x14c0 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1164 | "C:\Users\admin\AppData\Local\Temp\c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe" | C:\Users\admin\AppData\Local\Temp\c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
CobalStrike(PID) Process(1164) c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe C2 (1)47.99.72.48/cm BeaconTypeHTTP Port9898 SleepTime60000 MaxGetSize1048576 Jitter0 PublicKey-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWTRSy+lcQ/aN2IvR3URsb3j28
DXhUNy3NkEPdNrMTpnQs1R3NeGNZ7ySVVzSznV6WWZa/2c214GpyfVEk317h+BNy
9RKeCmw7V/mSkRXVWqEEdC9kOHL11HuJRpGpORSxWHlozRYYHe+bUiVGv85zmCGo
O4gv//4r69zUVyO9vwIDAQAB
-----END PUBLIC KEY----- DNS_strategyround-robin DNS_strategy_rotate_seconds-1 DNS_strategy_fail_x-1 DNS_strategy_fail_seconds-1 SpawnTod7a9ca15a07f82bfd3b63020da38aa16 Spawnto_x86%windir%\syswow64\rundll32.exe Spawnto_x64%windir%\sysnative\rundll32.exe CryptoScheme0 HttpGet_VerbGET HttpPost_VerbPOST HttpPostChunk0 Watermark391144938 bStageCleanupFalse bCFGCautionFalse UserAgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts) HttpPostUri/submit.php HttpGet_Metadata SessionId (2)base64 header: Cookie HttpPost_Metadata ConstHeaders (1)Content-Type: application/octet-stream SessionId (1)parameter: id Output (1)print bUsesCookies0001 Proxy_BehaviorUse IE settings tcpFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 smbFrameHeader0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 KillDate0-0-0 bProcInject_StartRWXTrue bProcInject_UseRWXTrue bProcInject_MinAllocSize0 ProcInject_PrependAppend_x86000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... ProcInject_PrependAppend_x64000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000... ProcInject_Stubb50b86d735412685eb6044ad8d01781c ProcInject_AllocationMethodVirtualAllocEx | |||||||||||||||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
1828 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6984 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
6984 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | GET | 200 | 47.99.72.48:9898 | http://47.99.72.48:9898/cm | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
608 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6260 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | 47.99.72.48:9898 | — | Hangzhou Alibaba Advertising Co.,Ltd. | CN | unknown |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1828 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1828 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Possibly Unwanted Program Detected | ET ADWARE_PUP Fun Web Products Spyware User-Agent (FunWebProducts) |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Targeted Malicious Activity was Detected | ET MALWARE Cobalt Strike Beacon Observed |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Targeted Malicious Activity was Detected | ET MALWARE Cobalt Strike Beacon Observed |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Targeted Malicious Activity was Detected | ET MALWARE Cobalt Strike Beacon Observed |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Targeted Malicious Activity was Detected | ET MALWARE Cobalt Strike Beacon Observed |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon |
1164 | c3c1338eaa4025e765e84b85e277ed5a319a7d732ff2054b67aba83578386825.exe | Targeted Malicious Activity was Detected | ET MALWARE Cobalt Strike Beacon Observed |