analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

dq.exe

Full analysis: https://app.any.run/tasks/02b812fd-cad8-4725-9061-0d285cb8487e
Verdict: Malicious activity
Analysis date: August 12, 2022, 22:19:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

1F2FD5B115B48F2A060E11F60CD3D7F1

SHA1:

BDD4D645C491A34C6084543CB7F47B27B0A28611

SHA256:

DE7148BDE8009AEC346D978E6836E6AEC1AE741E1AD58851EBFBCEAB7C1B5348

SSDEEP:

24576:mbaBr/DduQqmzhFfvRUKd/k6Ub1G8hzKP//7A3V3:VBrZkYZoRG8VKP//s3V3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • msdt.exe (PID: 3816)
      • csc.exe (PID: 3892)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 1564)

  • SUSPICIOUS

    • Checks supported languages

      • dq.exe (PID: 3596)
      • cvtres.exe (PID: 3432)
      • csc.exe (PID: 3892)
      • dq.exe (PID: 2516)

    • Drops a file with a compile date too recent

      • msdt.exe (PID: 3816)
      • csc.exe (PID: 3892)

    • Executable content was dropped or overwritten

      • msdt.exe (PID: 3816)
      • csc.exe (PID: 3892)

    • Executed via COM

      • sdiagnhost.exe (PID: 1564)

  • INFO

    • Checks supported languages

      • msdt.exe (PID: 3816)
      • pcwrun.exe (PID: 3360)
      • sdiagnhost.exe (PID: 1564)

    • Reads the computer name

      • msdt.exe (PID: 3816)
      • sdiagnhost.exe (PID: 1564)

    • Manual execution by user

      • pcwrun.exe (PID: 3360)
      • dq.exe (PID: 2516)

    • Checks Windows Trust Settings

      • msdt.exe (PID: 3816)
      • sdiagnhost.exe (PID: 1564)

    • Reads settings of System Certificates

      • msdt.exe (PID: 3816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

Subsystem: Windows command line
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x9679a
UninitializedDataSize: -
InitializedDataSize: 380416
CodeSize: 724480
LinkerVersion: 14.29
PEType: PE32
TimeStamp: 2022:08:13 00:19:18+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 12-Aug-2022 22:19:18
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000108

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 12-Aug-2022 22:19:18
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B0C04
0x000B0E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61429
.rdata
0x000B2000
0x0004AD74
0x0004AE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.20351
.data
0x000FD000
0x00007E34
0x00005200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.88496
.rsrc
0x00105000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.7123
.reloc
0x00106000
0x00009C6C
0x00009E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.59786

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
USER32.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
7
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start dq.exe no specs pcwrun.exe no specs msdt.exe sdiagnhost.exe no specs csc.exe cvtres.exe no specs dq.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3596"C:\Users\admin\Desktop\dq.exe" C:\Users\admin\Desktop\dq.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\dq.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3360C:\Windows\system32\pcwrun.exe "C:\Users\admin\Desktop\dq.exe"C:\Windows\system32\pcwrun.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Program Compatibility Troubleshooter Invoker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\pcwrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
3816C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\admin\AppData\Local\Temp\PCWE67D.xml /skip TRUEC:\Windows\System32\msdt.exe
pcwrun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1564C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3892"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\zbo8pcza.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
3432C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESEC3B.tmp" "c:\Users\admin\AppData\Local\Temp\CSCEC2A.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2516"C:\Users\admin\Desktop\dq.exe" C:\Users\admin\Desktop\dq.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\dq.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
Total events
4 166
Read events
4 144
Write events
22
Delete events
0

Modification events

(PID) Process:(3816) msdt.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1564) sdiagnhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1564) sdiagnhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1564) sdiagnhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1564) sdiagnhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
3
Suspicious files
7
Text files
17
Unknown types
3

Dropped files

PID
Process
Filename
Type
3596dq.exeC:\Users\admin\ntuser.ini.protectedbinary
MD5:6ED6D7F238B1CF5F1A127ED11AB4CB0C
SHA256:3F1CE1D93367E0F691BA4E5A73B1370F66EC2011473279E1ED6CD80675786BB5
3892csc.exeC:\Users\admin\AppData\Local\Temp\CSCEC2A.tmpres
MD5:72DB3E3DB1F6E329E5B3322CC71E506D
SHA256:6D2324E3BBADAE7E45C395C633460BD80AD56C68087363F2E391AA2D9A3219D8
3816msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_1221cd44-8ca7-40da-a3e8-2714e910365d\result\ResultReport.xmlxml
MD5:3ED9D40FDD9E6D02A36EBBB77FF90F9C
SHA256:E0F36D5A21681B78E59D9B3F06B615C0BD428CF1180CF27AE168BD3CD55F4DC4
3432cvtres.exeC:\Users\admin\AppData\Local\Temp\RESEC3B.tmpo
MD5:642B8F0B3CF6EB6F9099D59473C73D5D
SHA256:E8A357038C5C863180BCDAD3B2476A57E78109469548B9CDB11C9A225DCD9B99
3892csc.exeC:\Users\admin\AppData\Local\Temp\zbo8pcza.outtext
MD5:44C82C521743DA78CC5CC79A2C3CD315
SHA256:8786DDFB30FC77D945DC1D48509E0948CD1CF723082B80A4BE69727F38E54AC4
1564sdiagnhost.exeC:\Users\admin\AppData\Local\Temp\zbo8pcza.cmdlinetext
MD5:31FF53EF390A09B69A271AA138C420FF
SHA256:2C4E32E18635A6B81685DF17C982A9825B1881DB590AF895C3F4A62942CD1F57
3892csc.exeC:\Users\admin\AppData\Local\Temp\zbo8pcza.dllexecutable
MD5:50D114B35572F5777A5CCFFF94B83570
SHA256:789D209B90FB3E8783546522E401B088B98BC1622F206FF52697F6E412D39FB2
3892csc.exeC:\Users\admin\AppData\Local\Temp\zbo8pcza.pdbpdb
MD5:44EC1A10BFD77F0C5B95DA1220DF1A0A
SHA256:C29094EF64244BB8984237EAB16EA21E4BAF0E6A9F22C741FBA66D3CBE558AEA
3360pcwrun.exeC:\Users\admin\AppData\Local\Temp\PCWE67D.xmlxml
MD5:80681B26E76818EC8BB3F99F3C1B1D97
SHA256:B32857E34DD8099890EC37E3D642C8738D942DEBA5FB85C0EDCB09FADCB7F0C2
3816msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_1221cd44-8ca7-40da-a3e8-2714e910365d\DiagPackage.diagpkghtml
MD5:18A906A43C1C3E27064DB30C81505234
SHA256:041430D1F0AE14300C46BDCD917C882F4850DA3D6010E3FBF692023655BC406E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
dq.exe