| File name: | snapshot.exe |
| Full analysis: | https://app.any.run/tasks/b3aa5df3-a0cd-472d-b4d0-369f19f458a1 |
| Verdict: | Malicious activity |
| Analysis date: | March 07, 2018, 08:11:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (console) Intel 80386, for MS Windows, UPX compressed |
| MD5: | F0DF99AE1EBDBF91031EAB586ACAF924 |
| SHA1: | 21C1BE7F3843D95FF72FFA56D90D54992A3A5F45 |
| SHA256: | D272BA629A473101EDF8EF3FC3351A4EFD0C89EC232C6EA1CF5944848FE74655 |
| SSDEEP: | 6144:S3zJlatbV8jF9N6Y2DWMmlKJOK+4kZyClkMfOLpRuR1dOXeRfIKrX2eUaKoSkI:SDatZ8PaDWQJSZyKkWA7UXdTTUaKoS/ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Low-level read access rights to disk partition
- vssvc.exe (PID: 3648)
- snapshot.exe (PID: 3380)
Modifies files in the system directory
- snapshot.exe (PID: 3380)
Creates or modifies windows services
- snapshot.exe (PID: 3380)
- vssvc.exe (PID: 3648)
Application launched itself
- chrome.exe (PID: 2292)
INFO
Reads settings of System Certificates
- chrome.exe (PID: 2292)
Dropped object may contain URL's
- snapshot.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.7) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.4) |
| .exe | | | DOS Executable Generic (23.4) |
| .vxd | | | VXD Driver (0.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2018:03:07 08:30:15+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 356352 |
| InitializedDataSize: | 12288 |
| UninitializedDataSize: | 823296 |
| EntryPoint: | 0x128f50 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 1.46.0.18023 |
| ProductVersionNumber: | 1.46.0.18023 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Tom Ehlert Software |
| FileDescription: | Drive Snapshot - Diskimaging for WindowsNT |
| FileVersion: | 1.46.18023 |
| InternalName: | Snapshot |
| LegalCopyright: | Copyright © 2001-2018 by tom ehlert |
| LegalTrademarks: | Drive Snapshot is a trademark of Tom Ehlert |
| OriginalFileName: | snapshot.exe |
| ProductName: | Drive Snapshot for WindowsNT |
| ProductVersion: | 1.46.18023 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
| Compilation Date: | 07-Mar-2018 07:30:15 |
| Detected languages: |
|
| CompanyName: | Tom Ehlert Software |
| FileDescription: | Drive Snapshot - Diskimaging for WindowsNT |
| FileVersion: | 1.46.18023 |
| InternalName: | Snapshot |
| LegalCopyright: | Copyright © 2001-2018 by tom ehlert |
| LegalTrademarks: | Drive Snapshot is a trademark of Tom Ehlert |
| OriginalFilename: | snapshot.exe |
| ProductName: | Drive Snapshot for WindowsNT |
| ProductVersion: | 1.46.18023 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x015A |
| Pages in file: | 0x004C |
| Relocations: | 0x0001 |
| Size of header: | 0x0005 |
| Min extra paragraphs: | 0x0C9C |
| Max extra paragraphs: | 0x0C9C |
| Initial SS value: | 0x10B1 |
| Initial SP value: | 0x0040 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x9701 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000097F0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 07-Mar-2018 07:30:15 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
UPX0 | 0x0000A000 | 0x000C9000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x000D3000 | 0x00057000 | 0x00056C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.99887 |
.rsrc | 0x0012A000 | 0x00003000 | 0x00003000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.86126 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
0 | 2.22322 | 20 | Latin 1 / Western European | German - Germany | RT_GROUP_ICON |
1 | 5.11505 | 965 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 2.98949 | 744 | Latin 1 / Western European | German - Germany | RT_ICON |
3 | 2.32322 | 20 | Latin 1 / Western European | German - Germany | RT_GROUP_ICON |
4 | 2.32322 | 20 | Latin 1 / Western European | German - Germany | RT_GROUP_ICON |
5 | 2.22322 | 20 | Latin 1 / Western European | German - Germany | RT_GROUP_ICON |
6 | 2.32322 | 20 | Latin 1 / Western European | German - Germany | RT_GROUP_ICON |
7 | 1.24663 | 744 | Latin 1 / Western European | German - Germany | RT_ICON |
8 | 7.29238 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
126 | 7.95343 | 4056 | Latin 1 / Western European | German - Germany | RT_BITMAP |
Imports
ADVAPI32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.DLL |
OLEAUT32.dll |
SETUPAPI.dll |
SHELL32.dll |
USER32.dll |
WININET.dll |
ole32.dll |
Total processes
47
Monitored processes
11
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1664 | "C:\Users\admin\AppData\Local\Temp\snapshot.exe" | C:\Users\admin\AppData\Local\Temp\snapshot.exe | — | explorer.exe | |||||||||||
User: admin Company: Tom Ehlert Software Integrity Level: MEDIUM Description: Drive Snapshot - Diskimaging for WindowsNT Exit code: 3221226540 Version: 1.46.18023 Modules
| |||||||||||||||
| 2292 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | — | explorer.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 2668 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=2304 --on-initialized-event-handle=296 --parent-handle=300 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 2760 | "c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=23.129.0 --initial-client-data=0xe4,0xec,0xf0,0xe8,0xf4,0x55c42c,0x55c43c,0x55c44c | c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe | — | software_reporter_tool.exe | |||||||||||
User: admin Company: Google Integrity Level: MEDIUM Description: Software Reporter Tool Exit code: 0 Version: 23.129.0 | |||||||||||||||
| 2932 | "C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe" --session-id=e7KHV3oE4kGwH24eSMxqXqS6n7TzRJuJKWfdW1bx | C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Integrity Level: MEDIUM Description: Software Reporter Tool Exit code: 0 Version: 23.129.0 Modules
| |||||||||||||||
| 3260 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x72757d7c,0x72757da4,0x72757d8c | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 3280 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,550373321382006180,7538072452733395165,131072 --service-pipe-token=654F5EA16D9F2C287BE418A2B3EB49EA --lang=en-US --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=654F5EA16D9F2C287BE418A2B3EB49EA --renderer-client-id=4 --mojo-platform-channel-handle=1628 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 3380 | "C:\Users\admin\AppData\Local\Temp\snapshot.exe" | C:\Users\admin\AppData\Local\Temp\snapshot.exe | explorer.exe | ||||||||||||
User: admin Company: Tom Ehlert Software Integrity Level: HIGH Description: Drive Snapshot - Diskimaging for WindowsNT Exit code: 1 Version: 1.46.18023 Modules
| |||||||||||||||
| 3608 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,550373321382006180,7538072452733395165,131072 --service-pipe-token=DCA5D721AF6F7357ADDDA4ACEB947D7B --lang=en-US --disable-client-side-phishing-detection --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=DCA5D721AF6F7357ADDDA4ACEB947D7B --renderer-client-id=5 --mojo-platform-channel-handle=1548 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 3648 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
777
Read events
566
Write events
207
Delete events
4
Modification events
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | DialogSettings |
Value: AC000000A0000000 | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile0 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile1 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile2 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile3 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile4 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile5 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile6 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile7 |
Value: | |||
| (PID) Process: | (3380) snapshot.exe | Key: | HKEY_CURRENT_USER\Software\SnapShot |
| Operation: | write | Name: | RecentFile8 |
Value: | |||
Executable files
1
Suspicious files
10
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3380 | snapshot.exe | C: | — | |
MD5:— | SHA256:— | |||
| 3380 | snapshot.exe | C:\Users\admin\Documents\HD1-1.sna | — | |
MD5:— | SHA256:— | |||
| 3380 | snapshot.exe | C:\Users\admin\Documents\test.hsh | — | |
MD5:— | SHA256:— | |||
| 3380 | snapshot.exe | C:\Users\admin\Documents\test.SNA | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\03ac7e47-813b-4756-a387-a20bf5c24469.tmp | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\index | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0 | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 | — | |
MD5:— | SHA256:— | |||
| 2292 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2 | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
6
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 172.217.22.99:443 | www.google.it | Google Inc. | US | whitelisted |
— | — | 216.58.208.35:443 | www.gstatic.com | Google Inc. | US | whitelisted |
— | — | 172.217.16.174:443 | apis.google.com | Google Inc. | US | whitelisted |
— | — | 216.58.207.67:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
— | — | 172.217.23.132:443 | www.google.com | Google Inc. | US | whitelisted |
— | — | 172.217.18.3:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
www.google.it |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
www.google.com |
| malicious |