File name:

d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe

Full analysis: https://app.any.run/tasks/113e9270-cc70-40f4-9e83-229901e9f576
Verdict: Malicious activity
Analysis date: September 27, 2022, 09:22:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

28A4C68D4AFF7E58D321065189FD68E3

SHA1:

884CCDE1C4732FEADC44ACF4C9289D97E3004D83

SHA256:

D2238BCFF8D4FF94256C8DF702A31182763FA55325040CD484BC9ABAE2E69C5A

SSDEEP:

12288:O4yERcXVFIXLfmSYgkkL+8h+afxQl9OUVfU:gI7rbp8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • okhacked.exe (PID: 976)

    • Deletes shadow copies

      • cmd.exe (PID: 832)
      • cmd.exe (PID: 3460)

    • Loads the Task Scheduler COM API

      • wbengine.exe (PID: 3776)

    • Task Manager has been disabled (taskmgr)

      • okhacked.exe (PID: 976)

    • Drops executable file immediately after starts

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)

    • Writes to a start menu file

      • okhacked.exe (PID: 976)

    • Steals credentials from Web Browsers

      • okhacked.exe (PID: 976)

    • Actions looks like stealing of personal data

      • okhacked.exe (PID: 976)

    • Starts BCDEDIT.EXE to disable recovery

      • cmd.exe (PID: 3036)

    • Modifies files in Chrome extension folder

      • okhacked.exe (PID: 976)

  • SUSPICIOUS

    • Checks supported languages

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)
      • cmd.exe (PID: 832)
      • okhacked.exe (PID: 976)
      • WMIC.exe (PID: 1104)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3036)

    • Starts itself from another location

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)

    • Reads the computer name

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)
      • okhacked.exe (PID: 976)
      • WMIC.exe (PID: 1104)

    • Executed as Windows Service

      • vssvc.exe (PID: 3136)
      • vds.exe (PID: 1372)
      • wbengine.exe (PID: 3776)

    • Creates files in the Windows directory

      • wbadmin.exe (PID: 3400)

    • Starts CMD.EXE for commands execution

      • okhacked.exe (PID: 976)

    • Executed via COM

      • vdsldr.exe (PID: 448)

    • Executable content was dropped or overwritten

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)

    • Drops a file with a compile date too recent

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)

    • Creates files in the program directory

      • okhacked.exe (PID: 976)

    • Creates files in the user directory

      • d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe (PID: 3148)
      • okhacked.exe (PID: 976)

  • INFO

    • Reads the computer name

      • vssadmin.exe (PID: 3664)
      • wbengine.exe (PID: 3776)
      • wbadmin.exe (PID: 3400)
      • vssvc.exe (PID: 3136)
      • vdsldr.exe (PID: 448)
      • vds.exe (PID: 1372)

    • Checks supported languages

      • vssvc.exe (PID: 3136)
      • bcdedit.exe (PID: 272)
      • bcdedit.exe (PID: 3108)
      • wbadmin.exe (PID: 3400)
      • wbengine.exe (PID: 3776)
      • vdsldr.exe (PID: 448)
      • vds.exe (PID: 1372)
      • NOTEPAD.EXE (PID: 2108)
      • vssadmin.exe (PID: 3664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2022-Sep-26 05:03:02
FileDescription: -
FileVersion: 0.0.0.0
InternalName: OkHackedRansomware.exe
LegalCopyright: -
OriginalFilename: OkHackedRansomware.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2022-Sep-26 05:03:02
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
551636
551936
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.12665
.rsrc
565248
1288
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.8034
.reloc
573440
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.20354
628
UNKNOWN
UNKNOWN
RT_VERSION
1 (#2)
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe okhacked.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272bcdedit /set {default} recoveryenabled noC:\Windows\system32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
448C:\Windows\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\msvcrt.dll
832"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy deleteC:\Windows\System32\cmd.exe—okhacked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
976"C:\Users\admin\AppData\Roaming\okhacked.exe" C:\Users\admin\AppData\Roaming\okhacked.exe
d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\okhacked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1104wmic shadowcopy deleteC:\Windows\System32\Wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1372C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\atl.dll
2108"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\read_it.txtC:\Windows\system32\NOTEPAD.EXE—okhacked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
3036"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noC:\Windows\System32\cmd.exe—okhacked.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3108bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\system32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3136C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 051
Read events
5 031
Write events
20
Delete events
0

Modification events

(PID) Process:(3148) d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3148) d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3148) d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3148) d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(976) okhacked.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateTask
Value:
C:\Users\admin\AppData\Roaming\okhacked.exe
(PID) Process:(976) okhacked.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(976) okhacked.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(976) okhacked.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(976) okhacked.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3108) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{345b46fd-a9f9-11e7-a83c-e8a4f72b1d33}\Elements\250000e0
Operation:writeName:Element
Value:
0100000000000000
Executable files
1
Suspicious files
667
Text files
499
Unknown types
1

Dropped files

PID
Process
Filename
Type
976okhacked.exeC:\Users\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\Users\Administrator\AppData\Local\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\Users\admin\AppData\Local\read_it.txttext
MD5:—
SHA256:—
3148d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exeC:\Users\admin\AppData\Roaming\okhacked.exeexecutable
MD5:—
SHA256:—
976okhacked.exeC:\Users\Public\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\Users\Default\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\Users\admin\AppData\Local\Adobe\A0A2C719-B8B1-4DC7-B33B-C50E709F20B0\read_it.txttext
MD5:—
SHA256:—
976okhacked.exeC:\Users\Administrator\read_it.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d2238bcff8d4ff94256c8df702a31182763fa55325040cd484bc9abae2e69c5a.exe