analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

player.exe

Full analysis: https://app.any.run/tasks/8a453ec1-51d2-4b78-a5dc-a98c478ac0b5
Verdict: Malicious activity
Analysis date: October 04, 2022, 22:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

94030698443301C3110BD471B73E91CC

SHA1:

2A07A9FDED095024A62ED4957ED012875D3C8458

SHA256:

DB1C71CD30E9E09A9B2448FE68A0D0F243731E1A6CC2F98976BCA0B2FE9BA287

SSDEEP:

24576:Z5xolYQY6Z4CrM5Lod956Y0YBSZepsssv+3pzaAP7PgQGTqVzssAzyJLa62X:cYY4bdojf0ksss+zzjPraqPAoOfX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • player.exe (PID: 3292)
      • player.exe  (PID: 1064)

    • Application was dropped or rewritten from another process

      • player.exe  (PID: 1064)
      • SmartPlayer.exe (PID: 4064)

    • Loads dropped or rewritten executable

      • SmartPlayer.exe (PID: 4064)

  • SUSPICIOUS

    • Checks supported languages

      • player.exe (PID: 3292)
      • player.exe  (PID: 1064)
      • icsys.icn.exe (PID: 1880)
      • SmartPlayer.exe (PID: 4064)

    • Reads the computer name

      • player.exe (PID: 3292)
      • icsys.icn.exe (PID: 1880)
      • SmartPlayer.exe (PID: 4064)
      • player.exe  (PID: 1064)

    • Starts itself from another location

      • player.exe (PID: 3292)

    • Starts application with an unusual extension

      • player.exe (PID: 3292)

    • Drops a file with a compile date too recent

      • player.exe (PID: 3292)
      • player.exe  (PID: 1064)

    • Executable content was dropped or overwritten

      • player.exe (PID: 3292)
      • player.exe  (PID: 1064)

    • Creates files in the user directory

      • player.exe  (PID: 1064)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (54.9)
.exe | Win32 Executable MS Visual C++ (generic) (20.8)
.exe | Win64 Executable (generic) (18.4)
.exe | Win32 Executable (generic) (3)
.exe | Generic Win/DOS Executable (1.3)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2011-Jun-14 19:01:16
Detected languages:
  • English - United States
CompanyName: Microsoft
ProductName: Win
FileVersion: 1.00
ProductVersion: 1.00
InternalName: Win
OriginalFilename: Win.exe

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 184

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2011-Jun-14 19:01:16
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
173864
176128
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.9472
.data
180224
7028
4096
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
188416
1504
4096
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.73242

Resources

Title
Entropy
Size
Codepage
Language
Type
1
1.97095
20
Unicode (UTF 16LE)
UNKNOWN
RT_GROUP_ICON
30001
5.89846
3280
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
1 (#2)
3.12197
500
Unicode (UTF 16LE)
English - United States
RT_VERSION

Imports

MSVBVM60.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start player.exe player.exe  icsys.icn.exe no specs smartplayer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3292"C:\Users\admin\AppData\Local\Temp\player.exe" C:\Users\admin\AppData\Local\Temp\player.exe
Explorer.EXE
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
1064c:\users\admin\appdata\local\temp\player.exe  c:\users\admin\appdata\local\temp\player.exe 
player.exe
User:
admin
Integrity Level:
MEDIUM
1880C:\Users\admin\AppData\Local\icsys.icn.exeC:\Users\admin\AppData\Local\icsys.icn.exe—player.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
4064"C:\Users\admin\AppData\Roaming\SPTemp\SmartPlayer.exe" c:\users\admin\appdata\local\tempC:\Users\admin\AppData\Roaming\SPTemp\SmartPlayer.exe—player.exe 
User:
admin
Integrity Level:
MEDIUM
Description:
Smart Player
Version:
Total events
1 155
Read events
1 015
Write events
140
Delete events
0

Modification events

(PID) Process:(3292) player.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(1880) icsys.icn.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(1064) player.exe Key:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1064) player.exe Key:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1064) player.exe Key:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1064) player.exe Key:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4064) SmartPlayer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
SmartPlayer.exe
(PID) Process:(4064) SmartPlayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:Name
Value:
SmartPlayer.exe
(PID) Process:(4064) SmartPlayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication
Operation:writeName:ID
Value:
Executable files
9
Suspicious files
3
Text files
254
Unknown types
0

Dropped files

PID
Process
Filename
Type
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_playbar.pngimage
MD5:3B0F1C454F6D9CF3690B4C0E4365D48A
SHA256:C3A2FBAD98AE9BDCE59A031A0CAE6A2C19966823D1E59F9AC4881CBF462E02D9
3292player.exeC:\users\admin\appdata\local\temp\player.exe executable
MD5:0B4355F117D58B3CC92A816A1BE9073E
SHA256:637BB3C223162C54FE0797AD541118866A6345D12A860B7BDEE147840BE0493F
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_date_down.pngimage
MD5:1EE8219F76C8C8FB8CB5419DC6E793D5
SHA256:F8DCC05414CFE32DD5A056D69ED1DFAA7B933F344D924736B6517967DD7889BB
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\BackwardDisable.pngimage
MD5:404240433F5E69B65C3063141CE1ABD4
SHA256:7CEE80518B1E2BED4FFAB4D3A1869D9EA1C4C6DCE4D864411C262806BCA0DBB9
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_edit.pngimage
MD5:9B4CCE0908C2345CEF78876D19E9695E
SHA256:362A16A64088FD885BC43597C0DBA4EB6F387444757EC760507BDE09E2264F2F
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_date_nor.pngimage
MD5:AB930A4072617F00266437D55B9116F4
SHA256:1CE744EA8219A2D13CAB712164A4D38CC7A009596083640C5A9FBBDEF1B78D0A
3292player.exeC:\Users\admin\AppData\Local\icsys.icn.exeexecutable
MD5:9BFB6FDD3E7CFA38DF7FEB05F8CA4D58
SHA256:FC82E235120790DF8664B08F8D500E9356B44F4821A855C100408E8606883922
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_date_disable.pngimage
MD5:EBF18C98215A5FD5D5E4DB9640A09E38
SHA256:004747283B132DFC0BF65D1B003C63237452DD678A351F5F59B8993F42B208BC
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\Skin\bg_filelisttitle.pngimage
MD5:EB5D1477C57B397E902B70FF68E1ECA0
SHA256:8D96449C007D36EED5A4AE2A75230CD020EEB7624875EB6297A668DA293F5B6F
1064player.exe C:\Users\admin\AppData\Roaming\SPTemp\SmartPlayer.7zcompressed
MD5:0E9B8DE57D5951D149C332F4DF021D03
SHA256:5DA7B523C9A7FF2C882EC5959513B21E5A83AFFFA3EC7CC02589A2AE35A7A866
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
player.exe 
ERROR:
player.exe 
start 7zUnzip main!
player.exe 
ERROR:
player.exe 
Extract7zZip succeed!
player.exe 
ERROR:
player.exe 
ShellExecute succeed!
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
player.exe